Invalid FieldReference issue in logstash

Hi All,
I am getting the below logstash exception stack trace after migrated from 6.5.4 to 7.3.0.
Does this mean Logstash is dropping out some events? Do I need to update any template to suppress these warnings. There is no other error trace other than the below warning. Can someone please advice on this. Thanks in advance

   [2019-08-11T10:02:09,886][WARN ][logstash.filters.kv      ] Exception while parsing KV {:exception=>"Invalid FieldReference: `Actor[akka`"}

Sukumar C

The kv filter adds fields to the event using event.set, which means the field name goes through "sprintf" processing. That in turn means that things like

{ "bar": "[foo][0]=a [foo][1]=[foo][0] [foo][2]=c"}

get parsed into

       "foo" => {
    "1" => "[foo][0]",
    "0" => "a",
    "2" => "c"

but it also means that the field name cannot contain unmatched square brackets.

A workaround would be to use mutate+gsub to change square bracket to some other character. You would need to use a ruby filter if you want to change the field name back after the kv filter.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.