LogStash::Json::ParserError: Unexpected character (':' (code 58))

Elastic Stack Elasticsearch
1

i am facing the unexpected character error code 58 in my json data. even after validation of the data the logstash is reporting the errors . below is the sample data , can anyone help why logstash reporting an error here.



{
	"http": {
		"request": {
			"headers": {
				"accept-api-version": ["resource=2.0"],
				"host": ["blue-csecidp.uat.abc.com:8443"],
				"user-agent": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"],
				"x-forgerock-transactionid": ["ZIIZ9s_ewIWfgPhkrsqdxgAA234"],
				"x-forwarded-for": ["1.1.1.y"]
			},
			"secure": true,
			"method": "POST",
			"path": "https://blue-csecidp.uat.abc.com:8443/am/json/realms/root/realms/employee/authenticate",
			"queryParameters": {
				"authIndexType": ["service"],
				"authIndexValue": ["Push"]
			}
		}
	},
	"_id": "85f902e4-b971-4364-be35-07a4838bceed-195030431",
	"timestamp": "2023-06-08T18:12:07.186Z",
	"eventName": "AM-ACCESS-OUTCOME",
	"transactionId": "ZIIZ9s_ewIWfgPhkrsqdxgAAAII",
	"trackingIds": ["85f902e4-b971-4364-be35-07a4838bceed-195030421"],
	"client": {
		"ip": "1.1.1.x",
		"port": 23698
	},
	"response": {
		"status": "SUCCESSFUL",
		"statusCode": "200",
		"elapsedTime": 840,
		"elapsedTimeUnits": "MILLISECONDS"
	},
	"realm": "/employee",
	"component": "Authentication"
}
2

below is my logstash config

 filter {
                json { source => "message" }
                #### ACCESS AUDIT JSON Filtering
                if [application] == [ "CSEC-elk" ] {
                        ruby { code => 'h = event.get("[http][request][headers]")
                if h
                        h.each { |k, v| event.set("[headers][#{k}]", v[0]) }
                end'
                }
                 split { field => "[headers][_id]" }
                 mutate { rename => { "_id" => "[trac_id]" } }
                }

also i am getting warning with this filter in split field that

Only String and Array types are splittable. field:[headers][_id] is of type = NilClass

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.