Hey guys,
last week i decide to add Logsatsh service to my Elasticsearch cluster(3 nodes in AWS vpc)
until now we are use to index new docs using the Elastic Api without using Logstash.
The data type is JSON, and some of our docs failed to parse within Logstash.
So after we separated the docs that succeed to parse we found the reason is
some of our docs contains field named :
"Grandparent [level 4] Process Details": {"Process is signed": "Not checked",.....}
All the docs with fields that contains "[Level x]" fail to parse.
Any idea guy how to avoid it without change the field name?
Thanks, Guy.