Parsed JSON object/hash requires a target configuration option with json message

Elastic Stack Logstash
1

We met the following warning message as below under logstash 7.3

Parsed JSON object/hash requires a target configuration option {:source=>"message", :raw=>"[{\"itemBefore\":0,\"itemAward\":1,\"itemType\":\"hint\"}]"}

and the config

filter {
  json{
    source => "message"
    skip_on_invalid_json => true
    remove_field => [ "message" ]
  }
}

After searching the relate issue here, we cannot find the answer. Could someone help us to investigate it ?

2

The source JSON is an array. An array has to be in a named field, that's why it requires a target option.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.