Logstash json input {}, “” filter

I want to get a json-style event that contains "" or {}. However, if "" and {} are included, filtering is not done properly.

Is there no way??

msg:
{"key1":"val1","key2":"val2", "key3": "asfqwe12\"wef\"qw{asd}e213524" }

config:

filter {
    json{
       source => "message"
    }
    mutate {
        gsub => [ "message", "\n", "\\n" ]
        gsub => ["message", "\t", ""]
    }
    json{
        source => "message"
    }
    mutate {
        gsub => [ "message", "\\n", "
" ]
    }
}

What does that mean?

Why do you have two json filters?

  1. I tried twice for \ n or \ t because of json filtering failure. can delete the top json filter.

  2. "key3": "asfqwe12 \" wef \ "qw {asd} e213524"
    

    If log contains {} ""
    like above, json filtering fails.
    I want to solve this.

I just want to get it as a regular expression rather than a json format.

I am unable to reproduce the issue

input { generator { count => 1 message => ' {"key1":"val1","key2":"val2", "key3": "asfqwe12\"wef\"qw{asd}e213524" } ' } }

filter { json { source => "message" } }

output { stdout { codec => rubydebug { metadata => false } } }

produces this

      "key3" => "asfqwe12\"wef\"qw{asd}e213524",
   "message" => " {\"key1\":\"val1\",\"key2\":\"val2\", \"key3\": \"asfqwe12\\\"wef\\\"qw{asd}e213524\" } ",
      "key1" => "val1",
      "key2" => "val2"
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.