# Logstash failed to index
**URL:** https://discuss.elastic.co/t/logstash-failed-to-index/194712
**Category:** Logstash
**Created:** [August 10, 2019, 1:16pm UTC](https://discuss.elastic.co/t/logstash-failed-to-index/194712 "2019-08-10T13:16:09Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Guyk](https://discuss.elastic.co/u/Guyk)
#### Post date: [August 10, 2019, 1:16pm UTC](https://discuss.elastic.co/t/logstash-failed-to-index/194712/1 "2019-08-10T13:16:09Z")
Hey guys,
last week i decide to add Logsatsh service to my Elasticsearch cluster(3 nodes in AWS vpc)
until now we are use to index new docs using the Elastic Api without using Logstash.
The data type is JSON, and some of our docs failed to parse within Logstash.
So after we separated the docs that succeed to parse we found the reason is
some of our docs contains field named :
"Grandparent [level 4] Process Details": {"Process is signed": "Not checked",.....}
All the docs with fields that contains "_[Level x]_" fail to parse.
Any idea guy how to avoid it without change the field name?
Thanks, Guy.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 10, 2019, 1:47pm UTC](https://discuss.elastic.co/t/logstash-failed-to-index/194712/2 "2019-08-10T13:47:28Z")
This is a known [issue](https://github.com/logstash-plugins/logstash-filter-json/issues/38). I am not aware of a workaround.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2019, 1:47pm UTC](https://discuss.elastic.co/t/logstash-failed-to-index/194712/3 "2019-09-07T13:47:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.