Logstash JSON Parser is just parsing fields if no target is defined

Elastic Stack Logstash
1

Hello,

I am currently trying to parse a JSON message through the JSON filter. Without defining any target it works perfectly. When adding a target field it is not parsing any more throwing this error:

response=>{"index"=>{"_index"=>"filebeat-7.5.0", "_type"=>"_doc", "_id"=>"-iuXPnABPP-AmVbj8tut", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [service] of type [text] in document with id '-iuXPnABPP-AmVbj8tut'. Preview of field's value: '{instance=ef92a628-34fb-4007-a3a0-d312cb05f108, logger=CheckService, HealthStatus=Healthy, ElapsedMilliseconds=0.5995[...]

{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:308"}}}}}

My Pipeline:

  filter {

          json {

            source => "logsource"

            skip_on_invalid_json => true

            target => "service"

          }

        }

When i remove the target => "service" it works fine.

I would like to have the fields created like this:
service.instance
service.logger
service.[...]

Does anyone have an Idea what am I doing wrong?

Thank you! :slight_smile:

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.