# Removing square brackets from json key in http input
**URL:** https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243
**Category:** Logstash
**Created:** [August 2, 2022, 8:56pm UTC](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243 "2022-08-02T20:56:39Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)
#### Post date: [August 2, 2022, 8:56pm UTC](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243/1 "2022-08-02T20:56:39Z")
Hi Community!
I've been having the following problem. I'm receiving, through http input filter, a JSON that has bracket square in the keys so Logstash isn't able to parse it, as result it returns a `_jsonparsefailure`.
An example of the JSON that I receive is the following:
```auto
{
"alertData": {
"name": "foo - bar",
"url": "manage",
"changes": {
"ssid[bar]": {
"label": "Splash page",
"newText": "None",
"oldText": "Click-through",
"changedBy": "foo",
"ssidId": null
}
},
"userId": 123
}
}
```
my pipeline is the following:
```auto
input {
http {
host => "0.0.0.0"
port => "8080"
codec => "json"
}
}
filter {
mutate {
remove_field => ["event", "http", "url", "@version"]
}
}
output {
elasticsearch {
hosts => "elasticsearch:9200"
user => "foo"
password => "bar"
index => "example"
codec => json_lines
}
}
```
I've found some discussions about it, like [this](https://discuss.elastic.co/t/need-help-removing-square-brackets-from-field-name-in-json-input/182351) or [this](https://github.com/elastic/logstash/issues/11608) other one, but they don't seem to work.
Thank you in advance!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 2, 2022, 9:12pm UTC](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243/2 "2022-08-02T21:12:59Z")
> [@Felipe\_Fuller](#):
>
> I've found some discussions about it, like [this](https://discuss.elastic.co/t/need-help-removing-square-brackets-from-field-name-in-json-input/182351) or [this](https://github.com/elastic/logstash/issues/11608) other one, but they don't seem to work.
You can work around this by removing the codec and using a json filter with the target option set.
---
### Author:  [@Ugo\_Sangiorgi](https://discuss.elastic.co/u/Ugo_Sangiorgi)
#### Post date: [August 2, 2022, 10:01pm UTC](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243/3 "2022-08-02T22:01:44Z")
That's likely not the problem, as `"ssid[bar]"` is actually a valid field name.
You can try debugging it by using an output to file{} or [logshark](https://github.com/ugosan/logshark).
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 2, 2022, 10:14pm UTC](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243/4 "2022-08-02T22:14:44Z")
> [@Ugo\_Sangiorgi](#):
>
> That's likely not the problem, as `"ssid[bar]"` is actually a valid field name.
Yes, it is valid, but until [very recently](https://github.com/elastic/logstash/pull/14044), although the JSON could be parsed, when the codec or filter tried to do an `event.set("ssid[bar]", ...)` it would get an invalid field reference, and there were corner cases where it would crash logstash completely.
---
### Author:  [@Ugo\_Sangiorgi](https://discuss.elastic.co/u/Ugo_Sangiorgi)
#### Post date: [August 3, 2022, 2:15pm UTC](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243/5 "2022-08-03T14:15:57Z")
@Badger thats true indeed, thanks! OP must be using a version lower than 8.3 then.
@Felipe_Fuller I have just tested it with Logstash 8.3.2 and it works, so you should just upgrade
---
### Author:  [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)
#### Post date: [August 3, 2022, 2:51pm UTC](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243/6 "2022-08-03T14:51:09Z")
That's correct, I'm using version 8.2. I think the easiest work around is the update because in my case, that field is dynamic meaning that I can receive different values inside of the square brackets. As conclusion, I updated my Logstash to 8.3.3 to test it and it worked as a charm!
Thank you very much @Badger and @Ugo_Sangiorgi for the help!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2022, 2:52pm UTC](https://discuss.elastic.co/t/removing-square-brackets-from-json-key-in-http-input/311243/7 "2022-08-31T14:52:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.