Trying to collect data through HEC with json event containing empty values

[davidlg]

Hello,

I obtain a  "Failed processing http input" when trying to collect the following json event with indexed fields :

{"index" : "test",  "sourcetype", "test", "event":"This is a test", "fields" : { "name" : "test" , "values" : {}  }}

Error is : "Error in handling indexed fields"

Could anyone precise reason of the error ? "fields value" could not be empty ?

I can't prevent it on the source.

Best regards,

David

[ITWhisperer]

Is it a typo or just not valid JSON (the comma after "values" should be a colon?)

[davidlg]

Hello ITWhiperer, 

It is a typo, I just edited the original post.

Thank you