Logstash nested array JSON parsing

Elastic Stack Logstash
10

In the above output - you have a _jsonparsefailure because the message value is not correct JSON.

Further in the previous console output the JSON encoded text is malformed too. I have tried to pretty format it in a code editor, you can see that there is one too many closing } in the JSON.

{
  "msgs":[
    {
      "ts":"2017-08-30T06:21:11.6956712Z",
      "tid":17,
      "eid":1,
      "lvl":"Information",
      "cat":"Microsoft.AspNetCore.Hosting.Internal.WebHost",
      "msg":{
        "cnt":"Request starting HTTP/1.1 POST http://localhost:20001/Processor text/xml; charset=utf-8 837",
        "Protocol":"HTTP/1.1",
        "Method":"POST",
        "ContentType":"text/xml; charset=utf-8",
        "ContentLength":837,
        "Scheme":"http",
        "Host":"localhost:20001",
        "PathBase":"",
        "Path":"/Processor",
        "QueryString":""
      }
    }
  } <------ MALFORMED JSON - NO CORRESPONDING "{"
  ],
  "RequestId":"G00008D4EF6F3BDFF5FC",
  "RequestPath":"/Processor",
  "Action":"http://servereps.mtxeps.com/TransactionService/SendTransaction",
  "Contract":"NCR.CP.GatewayService.IProcessorTransactionContract",
  "OperationName":"SendTransaction",
  "MethodName":"SendTransaction"
}

I would question how the msgs field is built because the rest of the field names at the root level of the JSON object are PascalCase formatted but "msgs" is not.

You will not be able to use the add_field or split if the json filter cannot parse the message field.