Json filter fails on negative numbers

Elastic Stack Logstash
1

Hello,
given the following input

{'Time': 1655214909, 'AAA': '[00AAA0AAA000A0]', 'Longitude': 12.368, 'Latitude': 41.9331, 'AltitudeGPS': 216.2, 'AltitudeMSL': 216.2, 'SpeedLat': -3.9, 'SpeedLon': 1.88, 'SpeedH': -6.98, 'homeLat': 41.9298, 'homeLon': 12.3709, 'BBB': '[0BBBBBBB00BB8B]'}

and the following config

filter {

    mutate {
        gsub => ["message", "'", '"']
    }

    json {
        source => "message"
    }

    date {
        match  => [ "Time", "UNIX"]
        target => "@timestamp"
    }
}

I receive the following parsing error message:

 Error parsing json {:source=>"message", :raw=>"[2022-06-14 15:54:57]:AAA[00AAA0AAA000A0] RF type:2, Protocol type:1, DataType:2, BBB:[0BBBBBBBBB00BB0B]", :exception=>#<LogStash::Json::ParserError: Unexpected character ('-' (code 45)): was expecting comma to separate Array entries
 at [Source: (byte[])"[2022-06-14 15:54:57]:AAA[00AAA1AAA000A0] RF type:2, Protocol type:1, DataType:2, BBB:[0BBBBBB00BB0B]"; line: 1, column: 7]>}

But, if no negative number is present in the input, the parsing completes successfully.

Is there any improvement on the config I can perform to deal with the "-"?
Thank for any help you could provide,
S.

2

Your message does not contain JSON. The parser will think the [ starts an array, then accepts the 2022, but blows up when it gets to the - separating the year and month.

3

Thank you for your reply.
The input and the filter config are reported in my first post. No other manipulation is performed.
Can you please help me understand how it comes that the input becomes [2022-06-14 15:54:57]:AAA[00AAA0AAA000A0]...

4

Clearly your input is not what you think it is.

5

thank you

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.