Logstash crashed down the elasticsearch

I use a logstash to fetching the data from the elasticsearch.
The logstash works well when I use an empty filter. But it crashes the remote elastic when I add a json filter.
The logstash.cong is as follow:

hosts => ""

source => "message"

stdout{codec => rubydebug}

It would be very unusual for you to need a json filter to parse the [message] field from an elasticsearch input. It is possible, but unusual.

What do you mean by "it crashes the remote elastic".

I mean when I create a logstash above, the elastic I am fetching from(in this case the elastic in crashed down (closed ).

If I want to read the "message" field from the elastic and filter on it, which filter I would use?

OK, if elasticsearch crashes I would expect it to log a message explaining why. You should open a thread in the elasticsearch forum including the message and asking for help with it.

If the [message] field contains JSON then a json filter is OK.

Thanks, the problem has been solved. I delete some white space in the filter and use grok instead.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.