Dear Community,
I've got server sending following json data via filebeat to logstash.
Logstash version is 6.2.4.
For some unknown reason to me, logstash returns following error during json filtering:
Error parsing json {:source=>"message", :raw=>"{orgId=100, fnrId=5740}\", \"action\":\"group login successful\" }", :exception=>#<LogStash::Json::ParserError: Unexpected character ('o' (code 111)): was expecting double-quote to start field name
at [Source: (byte[])"{orgId=100, fnrId=5740}", "action":"group login successful" }"; line: 1, column: 3]>}
This is the data that filebeat sends to Logstash:
{ "time":"2019-10-17T10:18:48.093Z", "node":"server", "tx":"92abv", "event":"qdgubk3i8huj-934991", "user":"user.name", "userOrg":"example.com", "session":"(md5)4ed2fbf0229d2d93e785c913c", "target":"user.name, fnrId {orgId=100, fnrId=5740}", "action":"group login successful" }
Why the Json filter plugin is trying to read json object from the target value string? Shouldn't it just read the whole value as String?
For my knowledge, example data is following JSON definitions.
Many thanks in advance!
Br,
Aki