Log JSON decoding errors of TCP input

(Reto Kaiser) #1

I'm setting up a Filebeat TCP input, that parses each line as JSON and sends the resulting fields to Elasticsearch.

- type: tcp
  host: ""

- decode_json_fields:
    fields: ["message"]
    target: ""
    overwrite_keys: true
- drop_fields:
    fields: ["message"]

  hosts: ['${ES_HOST}']
  username: '${ES_USERNAME}'
  password: '${ES_PASSWORD}'

When I send invalid JSON, an empty log entry is sent to Elasticsearch.

echo '{"test' | nc 5000

Is there a way to add the JSON decoding error to the log message? I can see the "log" input has an option add_error_key, but I can't find something similar for "tcp".


(Steffen Siering) #2

With your configuration the parsing is not done in the input, but the processor. Checking the docs and the code I didn't see any support for setting an error on failure. Please open an enhancement request.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.