ParserError with Code 111

Dear Community,

I've got server sending following json data via filebeat to logstash.
Logstash version is 6.2.4.
For some unknown reason to me, logstash returns following error during json filtering:

Error parsing json {:source=>"message", :raw=>"{orgId=100, fnrId=5740}\", \"action\":\"group login successful\" }", :exception=>#<LogStash::Json::ParserError: Unexpected character ('o' (code 111)): was expecting double-quote to start field name
 at [Source: (byte[])"{orgId=100, fnrId=5740}", "action":"group login successful" }"; line: 1, column: 3]>}

This is the data that filebeat sends to Logstash:

{ "time":"2019-10-17T10:18:48.093Z", "node":"server", "tx":"92abv", "event":"qdgubk3i8huj-934991", "user":"", "userOrg":"", "session":"(md5)4ed2fbf0229d2d93e785c913c", "target":", fnrId {orgId=100, fnrId=5740}", "action":"group login successful" }

Why the Json filter plugin is trying to read json object from the target value string? Shouldn't it just read the whole value as String?
For my knowledge, example data is following JSON definitions.

Many thanks in advance!


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.