I'm having difficulty in parsing json object, the json field name is having special characters in it and logstash is showing error as JSON parse error, original data now in message field.
ERROR message: JSON parse error, original data now in message field {:message=>"Invalid FieldReference: ${http.headers[\"User-Agent\"]}
", :exception=>LogStash::Json::ParserError
RAW message field that it trying to parse:
"customMsgAtts": {
"${http.headers["User-Agent"]}": "XXXX/X.X.X_XXX",
},
I tried to rename the field as below, but that doesn't work:
mutate {rename => { "[customMsgAtts][${http.headers["User-Agent"]}]" => "http_headers_User_Agent" }}