logstash-plugins/logstash-filter-json

JSON Filter throws a warning (and fails to insert document) when object has a 'message' field

orweinberger opened this issue · 2 comments

orweinberger commented

Running Logstash v2.3.2

When trying to ship logs from Filebeat, the content is placed under a message field, in my case I'm shipping JSON documents so I need to tell Logstash to convert and expand the original document with the JSON document within message, I do it like this:

filter {
  json {
    source => "message"
  }
}

However, since my JSON document also has a message field, I get this error:

{:timestamp=>"2016-06-09T13:52:59.647000+0000", :message=>"Parsed JSON object/hash requires a target configuration option", :source=>"message", :raw=>"", :level=>:warn}

As a workaround I've changed one of the message fields to message2.

Tsury commented

Sometimes this workaround is not possible. I am using FileBeat -> Kafka -> Logstash and my JSON doesn't even contain a "message" field; it's FileBeat and Kafka who add this field.

How can i work around this?