# Logstash adding unwanted \\ \\ to field name
**URL:** https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877
**Category:** Logstash
**Created:** [March 28, 2018, 7:08am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877 "2018-03-28T07:08:21Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [March 28, 2018, 7:08am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877/1 "2018-03-28T07:08:21Z")
Hi,
I'm using the http\_poller to poll for some data and this is working fine except for one site. The site provides data in JSON and it displays fine in a browser and doesn't show the \ in rawdata view but for some reason logstash is encapsulating every field in \fieldname\ which leans to JSON parse failures.
I tried adding a gsub filter to remove the backslashes but that doesn't work either.
Part of the JSON from stdout with codec =\> plain. Setting it to json will result in the same but with a parse error. Rest of the config is normal and works fine with other websites.
`"[{\"uptime\":55485,\"dataLinkState\":\"Established\",\"state\":\"In Network\",\"netlock\":{\"state\":\"Remote Lock Not Engaged\"}}]"`
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 28, 2018, 7:42am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877/2 "2018-03-28T07:42:13Z")
Please show
- your pipeline configuration,
- an example document produced by Logstash (use a `stdout { codec => rubydebug }` output or copy/paste from Kibana's JSON tab), and
- the JSON parsing error message.
---
### Author:  [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [March 28, 2018, 7:51am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877/3 "2018-03-28T07:51:45Z")
```auto
input {
http_poller {
urls => {
url => "myip"
}
cacert => "cert.pem"
truststore => "truststore.jks"
user => "admin"
password => "pass"
truststore_password => "pass"
schedule => { cron => "50 * * * * UTC"}
codec => "json"
}
}
output {
stdout {
codec => rubydebug
}
}
```
stdoutput redacted
`
"message" => "[{\"uptime\":58896,\"dataLinkState\":\"Established\",\"state\":\"In Network\",\"netlock\":{\"state\":\"Remote Lock Not Engaged\"}}]"`
error
`[0] "_jsonparsefailure"`
edit: Logstash is adding all the backslashes, they are not in the original data. Backslashes are present with both the json and plain codec.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 28, 2018, 7:53am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877/4 "2018-03-28T07:53:10Z")
> error
> [0] "\_jsonparsefailure"
No, I want to see the error message from the Logstash log.
---
### Author:  [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)
#### Post date: [March 28, 2018, 8:00am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877/5 "2018-03-28T08:00:22Z")
Ah sorry.
```
[2018-03-28T16:49:17,326][INFO][logstash.inputs.http_poller] Registering http_poller Input {:type=>nil, :schedule=>{"cron"=>"50 * * * * UTC"}, :timeout=>nil}
[2018-03-28T16:49:17,333][INFO][logstash.pipeline] Pipeline started {"pipeline.id"=>"main"}
[2018-03-28T16:49:17,369][INFO][logstash.agent] Pipelines running {:count=>1, :pipelines=>["main"]}
[2018-03-28T16:50:01,370][ERROR][logstash.codecs.json] JSON parse error, original data now in message field {:error=>#, :data=>"[{\"uptime\":58896,\"dataLinkState\":\"Established\",\"state\":\"In Network\",\"netlock\":{\"state\":\"Remote Lock Not Engaged\"}} **redacted**
[2018-03-28T16:57:58,411][WARN][logstash.runner] SIGINT received. Shutting down the agent.
[2018-03-28T16:57:58,867][INFO][logstash.pipeline] Pipeline terminated {"pipeline.id"=>"main"}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 28, 2018, 11:35am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877/6 "2018-03-28T11:35:52Z")
`message` contains a list rather than an object and that doesn't fly with the json codec (because it can't store an array directly in the message). Use the plain codec and a json filter with `target` set to a field where you want the array stored.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 25, 2018, 11:36am UTC](https://discuss.elastic.co/t/logstash-adding-unwanted-to-field-name/125877/7 "2018-04-25T11:36:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.