From 88911e75a197f7eeeb5c24b6196569469ed866cb Mon Sep 17 00:00:00 2001 From: Vikas Sharma Date: Mon, 16 Apr 2018 21:19:05 +0530 Subject: [PATCH] Add raw json field when unmarshaling fails (#6591) Add raw json to `message` field when JSON unmarshaling fails. This ensures that no data loss occurs. Fixes #6516 --- CHANGELOG.asciidoc | 1 + filebeat/harvester/reader/json.go | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index ccb1cd4cb2d..4146204a85f 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -62,6 +62,7 @@ https://github.com/elastic/beats/compare/v6.0.0-beta2...master[Check the HEAD di - Fix panic when log prospector configuration fails to load. {issue}6800[6800] - Fix memory leak in log prospector when files cannot be read. {issue}6797[6797] +- Add raw JSON to message field when JSON parsing fails. {issue}6516[6516] *Heartbeat* diff --git a/filebeat/harvester/reader/json.go b/filebeat/harvester/reader/json.go index 0a7d2dbedb8..756fe4a3ac4 100644 --- a/filebeat/harvester/reader/json.go +++ b/filebeat/harvester/reader/json.go @@ -101,6 +101,13 @@ func MergeJSONFields(data common.MapStr, jsonFields common.MapStr, text *string, jsonFields[config.MessageKey] = *text } + // handle the case in which r.cfg.AddErrorKey is set and len(jsonFields) == 1 + // and only thing it contains is `error` key due to error in json decoding + // which results in loss of message key in the main beat event + if len(jsonFields) == 1 && jsonFields["error"] != nil { + data["message"] = *text + } + if config.KeysUnderRoot { // Delete existing json key delete(data, "json")