JSON Filter throws a warning (and fails to insert document) when object has a 'message' field

[orweinberger]

Running Logstash v2.3.2

When trying to ship logs from Filebeat, the content is placed under a message field, in my case I'm shipping JSON documents so I need to tell Logstash to convert and expand the original document with the JSON document within message, I do it like this:

filter {
  json {
    source => "message"
  }
}

However, since my JSON document also has a message field, I get this error:

{:timestamp=>"2016-06-09T13:52:59.647000+0000", :message=>"Parsed JSON object/hash requires a target configuration option", :source=>"message", :raw=>"", :level=>:warn}

As a workaround I've changed one of the message fields to message2.

[Tsury]

Sometimes this workaround is not possible. I am using FileBeat -> Kafka -> Logstash and my JSON doesn't even contain a "message" field; it's FileBeat and Kafka who add this field.

How can i work around this?

[jonashackt]

seems to be somehow connected to https://discuss.elastic.co/t/parsed-json-object-hash-requires-a-target-configuration-option/59354/2