# JSON filter Invalid FieldReference for \[ \]

**URL:** https://discuss.elastic.co/t/json-filter-invalid-fieldreference-for/287897
**Category:** Logstash
**Created:** [October 28, 2021, 9:31am UTC](https://discuss.elastic.co/t/json-filter-invalid-fieldreference-for/287897 "2021-10-28T09:31:39Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Wonder\_Garance](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wonder_garance/32/91180_2.png) [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)
#### Post date: [October 28, 2021, 9:31am UTC](https://discuss.elastic.co/t/json-filter-invalid-fieldreference-for/287897/1 "2021-10-28T09:31:39Z")

</div>

Hello, I'm using JSON filter to parse JSON files, the field title contains characters [and]  
I got this error:  
exception=\>#\<RuntimeError: Invalid FieldReference: `[case] index abc...`

As the whole value of this field should be indexed in Elasticsearch, I can't remove [and]  
The value is valid in JSON but is not parsable by logstash.  
How to correct it?

I found a similar topic:

> <https://github.com/elastic/logstash/issues/11608>
>
> Many issues have been reported, mainly related to JSON decoding either in a code…c or filter, where a \*valid\* JSON document contains keys that starts with a \`\[\` which is interpreted as a \[logstash field reference\](https://www.elastic.co/guide/en/logstash/7.4/field-references-deepdive.html) and results in an \`LogStash::Json::ParserError: Invalid FieldReference\` error. 
> 
> To reproduce:
> \`\`\`sh
> echo '{"\[foo":"bar"}' | bin/logstash -e 'input{stdin{codec=\>json\_lines}} output{stdout{codec=\>rubydebug}}'
> ...
> \[2020-02-19T11:46:58,786\]\[WARN \]\[logstash.codecs.jsonlines\]\[main\]\[ee68f56b1186b09c0ebc08387e2d8df11ff00788d3a22c61eeda228a073bb104\] JSON parse error, original data now in message field {:error=\>#\<LogStash::Json::ParserError: Invalid FieldReference: \`\[foo\`\>, :data=\>"{\\"\[foo\\":\\"bar\\"}"}
> {
> "@timestamp" =\> 2020-02-19T16:46:58.803Z,
> "message" =\> "{\\"\[foo\\":\\"bar\\"}",
> "host" =\> "mbp15r",
> "@version" =\> "1",
> "tags" =\> \[
> \[0\] "\_jsonparsefailure"
> \]
> }
> \`\`\`
> 
> The problem we have is that the keys are in fact valid JSON but are not parsable by logstash and result in a bad user experience. 
> 
> I believe we should offer some way to mitigate that, maybe by allowing the user to specify some replacement character for the brackets that denote a field reference? Open to suggestions.
> 
> This relates to the FieldReference strict mode introduced in #9543
> 
> WDYT?

---

<div class="post-metadata">

### Author: ![Wonder\_Garance](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wonder_garance/32/91180_2.png) [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)
#### Post date: [October 28, 2021, 9:55am UTC](https://discuss.elastic.co/t/json-filter-invalid-fieldreference-for/287897/2 "2021-10-28T09:55:16Z")

</div>

I solved the problem by modifing my Logstash conf.  
Before:

```auto
filter {
  json {
    source => "message"
    add_field => {
      new_title => "%{[title][html]}"
    }
    remove_field => ["message", "%{[title]}"]
  }
}

```

After:

```auto
filter {
  json {
    source => "message"
    add_field => {
      new_title => "%{[title][html]}"
    }
    remove_field => ["message", "title"]
  }
}

```

But I don't know why this modification correct the parse JSON error.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 25, 2021, 9:55am UTC](https://discuss.elastic.co/t/json-filter-invalid-fieldreference-for/287897/3 "2021-11-25T09:55:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.