Good day all.

I am facing a bit of a pickle in regards to the Logstash JSON filter.

Our Opensearch stack is receiving some logs already parsed in a JSON format from FluentBit producers. However some fields seem for some reason to be containing unparsed JSON structures.

Example :

Field as seen in Opensearch Discover

The fields contents parse fine when I put them though an online JSON parser.

Field contents in online JSON parser

So I’ve decided to try to add some additional parsing with Logstash. The fields contents parse fine when I put them through individually trough a JSON filter in my local Logstash instance which I use for testing purposes. (I put the fields contents through the JSON filter using STDIN).

However when I put everything in production on our Logstash consumers and the whole log entry goes through my code I will get a _jsonparsefailure.

Error message thrown by Logstash

My code :

Logstash code used to try to parse the fields contents

I’d appreciate any help anyone can provide.

Many thanks!