Parse Error json object

Elastic Stack Logstash
1

Hi,
I am getting parse error like below

JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected character ('\' (code 92)): was expecting double-quote to start field name

Original Json

"{\"level\":\"info\",\"client_code\":\"xxx\",\"xxx\":\"xxx\",\"timestamp\":\"2020-10-15 16:17:25\",\"entity_type\":\"xxx\",\"entity\":\"xxx\",\"efid\":\"xxx\",\"pqid\":\"xxx\",\"count\":3000}"

Could you please provide solution

Regards,
Senthil. L

2

The double quotes in your source are escaped. You need to remove the escapes. A simplistic solution would be

mutate { gsub => [ "message", '\\"', '"' ] }

If there are quoted strings within the JSON then you would need a more sophisticated solution to parse it.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.