The JSON filter can extract empty field names, which are then unusable by Logstash

Elastic Stack Logstash
1

Hi, I've found a situation where the JSON filter and valid JSON can cause unusable Logstash events. It comes from 2 facts:

  1. An empty string is a valid JSON key, as explained for example in this stackoverflow answer.
  2. It isn't possible to access fields with empty names in Logstash.

The obvious solution of course is "use ruby"; but it seems like Logstash should be able to handle correctly parsed, valid JSON (not arguing whether it is sane). Is there something I missed?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.