Log stack freezing After starting API end point

Elastic Stack Logstash
21

The mutate+gsub is changing the value of the [message] field so that it becomes valid JSON. So it has to be done before the json filter.

22

@Badger
Still no luck.

filter {
  mutate { gsub => [ "message", "$", "]" ] }
  json {
    source => "message"	
	tag_on_failure => [ "_jsonparsefailure" ]
	target => "parsedJson"
	}
  
  split { field=> "parsedJson" }
}
23

Hi @Badger
any further advise?

24

What does the message field look like in elasticsearch now?