Hi, I'm using the http_poller to poll for some data and this is working fine except for one site. The site provides data in JSON and it displays fine in a browser and doesn't show the \ in rawdata view but for some reason logstash is encapsulating every field in \fieldname\ which leans to JSON pars…

message contains a list rather than an object and that doesn't fly with the json codec (because it can't store an array directly in the message). Use the plain codec and a json filter with target set to a field where you want the array stored.

Discuss the Elastic Stack

Logstash adding unwanted \ \ to field name

Elastic Stack Logstash

magnusbaeck (Magnus Bäck) March 28, 2018, 7:53am 4

error
[0] "_jsonparsefailure"

No, I want to see the error message from the Logstash log.

Topic		Replies	Views
Logstash json parse error Logstash	16	29832	March 13, 2017
Stop grok from adding backslash automatically to escape \ Logstash	9	3197	April 2, 2018
How to remove backslash from weird formatted json Logstash	5	5273	August 18, 2021
Logstash - json filter removes backslash Logstash	5	1039	February 13, 2019
Parse Logstash.log with logstash Logstash	2	727	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash adding unwanted \ \ to field name

Related topics