JSON filter Invalid FieldReference for [ ]

Elastic Stack Logstash
1

Hello, I'm using JSON filter to parse JSON files, the field title contains characters [ and ]
I got this error:
exception=>#<RuntimeError: Invalid FieldReference: [case] index abc...

As the whole value of this field should be indexed in Elasticsearch, I can't remove [ and ]
The value is valid in JSON but is not parsable by logstash.
How to correct it?

I found a similar topic:

2

I solved the problem by modifing my Logstash conf.
Before:

filter {
  json {
    source => "message"
    add_field => {
      new_title => "%{[title][html]}"
    }
    remove_field => ["message", "%{[title]}"]
  }
}

After:

filter {
  json {
    source => "message"
    add_field => {
      new_title => "%{[title][html]}"
    }
    remove_field => ["message", "title"]
  }
}

But I don't know why this modification correct the parse JSON error.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.