Hi, I have json data which is harvested by filebeat and shipped to logstash. Filebeat encapsulating the orginal json message in message field by default. I didn't change it. What I want to do (in logstash): parse json string stored in message for the case that parsing fails, I want to keep the …

Why different behavior on @metadata vs normal fields?

Badger November 15, 2019, 3:13pm 2

You are hitting this bug.

Topic		Replies	Views
Having issues with a specific "message" field while parsing using Filebeat and Logstash Logstash	19	9912	May 9, 2018
Create temp metadata field using regex in message field and parse json Logstash	7	724	September 8, 2020
Issue with message field while parsing JSON Logstash	3	356	August 2, 2019
How to remove original message field after parsing using json filter Logstash	2	3337	June 3, 2021
Logstash Json Error Logstash	1	346	December 12, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Why different behavior on @metadata vs normal fields?

Related topics