topic Re: Trying to collect data through HEC with json event containing empty values in Getting Data In

Trying to collect data through HEC with json event containing empty values

davidlg — Thu, 07 Nov 2024 14:51:04 GMT

Hello,

I obtain a "Failed processing http input" when trying to collect the following json event with indexed fields :

{"index" : "test", "sourcetype", "test", "event":"This is a test", "fields" : { "name" : "test" , "values" : {} }}

Error is : "Error in handling indexed fields"

Could anyone precise reason of the error ? "fields value" could not be empty ?

I can't prevent it on the source.

Best regards,

David

ITWhisperer — Thu, 07 Nov 2024 14:47:15 GMT

Is it a typo or just not valid JSON (the comma after "values" should be a colon?)

davidlg — Thu, 07 Nov 2024 14:52:38 GMT

Hello ITWhiperer,

It is a typo, I just edited the original post.

Thank you