Invalid FieldReference issue in logstash

[sukku77 (Sukumar C)]

Hi All,
I am getting the below logstash exception stack trace after migrated from 6.5.4 to 7.3.0.
Does this mean Logstash is dropping out some events? Do I need to update any template to suppress these warnings. There is no other error trace other than the below warning. Can someone please advice on this. Thanks in advance

   [2019-08-11T10:02:09,886][WARN ][logstash.filters.kv      ] Exception while parsing KV {:exception=>"Invalid FieldReference: `Actor[akka`"}

Regards
Sukumar C

[Badger]

The kv filter adds fields to the event using event.set, which means the field name goes through "sprintf" processing. That in turn means that things like

{ "bar": "[foo][0]=a [foo][1]=[foo][0] [foo][2]=c"}

get parsed into

       "foo" => {
    "1" => "[foo][0]",
    "0" => "a",
    "2" => "c"
},

but it also means that the field name cannot contain unmatched square brackets.

A workaround would be to use mutate+gsub to change square bracket to some other character. You would need to use a ruby filter if you want to change the field name back after the kv filter.