There is a string like\ x09\ x09\ x09 in the nginx log, which leads to the failure of logstash collection. Has anyone encountered and solved it?

there is a string like x09x09x09Version/ in the nginx log, which caused logstash to report an error when collecting Filter. Has anyone ever encountered the same problem and solved it?
nginx log content:

{"http_host": "xxxx", "@timestamp": "2018-07-05T13:54:24+08:00", "remote_addr": "10.0.0.23", "remote_user": "-", "request": "GET /article/index.html HTTP/1.1", "status": "200", "body_bytes_sent": "1166", "http_referrer": "-", "http_user_agent": "Mozilla/5.0 (Linux; Android 5.1.1; SM801 Build/LMY47V; wv) AppleWebKit/537.36 (KHTML, like Gecko) \x09\x09\x09Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/043015 Safari/537.36 V1_AND_SQ_6.6.9_482_YYB_D QQ/6.6.9.3060 NetType/2G WebP/0.3.0 Pixel/1080", "http_x_forwarded_for": "61.151.226.65, 10.255.0.3", "request_time": "0.000", "upstream_response_time": "-"}

logstash error log:

[2018-07-05T13:54:26,216][WARN ][logstash.filters.json    ] Error parsing json {:source=>"message", :raw=>"{\"http_host\": \"xxxxx\", \"@timestamp\": \"2018-
07-05T13:54:24+08:00\", \"remote_addr\": \"10.0.0.23\", \"remote_user\": \"-\", \"request\": \"GET /article/index.htmlHTTP/1.1\", \"status\": \"200\", \"body_bytes_sent\": \"1166\", \"http_referrer\": \"-\", \"http_user_agent\": \"Mozilla/5.0 (Linux; Android 5.1.1; SM801 Build/LM
Y47V; wv) AppleWebKit/537.36 (KHTML, like Gecko) \\x09\\x09\\x09Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/043015 Safari/537.36 V1_AND_SQ_6.6.9_482_YYB_
D QQ/6.6.9.3060 NetType/2G WebP/0.3.0 Pixel/1080\", \"http_x_forwarded_for\": \"61.151.226.65, 10.255.0.3\", \"request_time\": \"0.000\", \"upstream_response_time\": \
"-\"} ", :exception=>-sharp<LogStash::Json::ParserError: Unrecognized character escape "x" (code 120)
 at [Source: (byte[])"{"http_host": "xxxxx", "@timestamp": "2018-07-05T13:54:24+08:00", "remote_addr": "10.0.0.23", "remote_user": "-", "request": "GET /arti
cle/index.htmlHTTP/1.1", "status": "200", "body_bytes_sent": "1166", "http_referrer": "-", "http_user_agent": "Mo
zilla/5.0 (Linux; Android 5.1.1; SM801 Build/LMY47V; wv) AppleWebKit/537.36 (KHTML, like Gecko) \x09\x09\x09Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/0
43015 Safari/537.36 V"[truncated 183 bytes]; line: 1, column: 411]>}
Mar.23,2021

refer to http://qaru.site/questions/12.
to give solutions before and after logstash 5

Menu