Some messages are jsonparsed when coming from redis

Elastic Stack Logstash
1

Hi,

I use Redis to connect a Logstash Shipper and Indexer instance. All my filter rules are in the Indexer save for one that adds a field called "shipper" with a value representing the hostname of the node this shipper runs on. I set the "type" field on every input in the shipper.

Some messages now contain a message field which contains a string with all field names and field values I would expect, delimited by lots of "\" but no fields. For testing purposes I set the type to "redis" in the redis input in the indexer instance. These messages with the big message field have the "type" set to "redis" which should never happen, because type is set in the instance before redis for every message.

All of these strange messages have a tag called "_jsonparsefailure"

Strange thing is, I never use json only a "json_lines" in an output within in the indexer (the one after Redis) which forwards some messages to another logstash host on another host for further processing (namely sent them to Icinga Monitoring). This output to another logstash is used in parallel with the Elasticsearch output.

What leaves me totally puzzled is that many messages take the same path through the shipper, the redis, the indexer and even the output to the extra logstash instance for icinga. Put only some have this strange phenomenon that all the event is put into the message field and some others don't. I could not find a thing all changed events have in common which the others don't.

Could you give me a hint where I should look further?

Cheers,
Thomas

2

The logs say, that these messages have a different character encoding than expected. Since character encoding setting is deprecated, could you give me a hint how I could normalize the messages not knowing what is sent from other systems?

At least I can tell it's English and German in "usual" encodings, but the senders didn't tell me more details.

3

I can give myself the answer now.

It was indeed the encoding of the incoming events.

Now I use an if in the redis output. The messages from the source with different encoding go to another key in redis and I use the codec option, stating the codec.

... shuffle_hosts => true codec => json { charset => "ISO-8859-1" } key => "snmptrap" } ...

On the receiving end I have 2 redis inputs, one with the standard key, the other with other key and the same codec setting.

Hope this helps somebody in the future.