It seems that when you have a filter with a mutate that in turn has a doubly nested rename target, e.g. mutate { rename => [ "ProcessName", "[eventlog][process_name]" ] }, then you get exceptions if the incoming json_lines-encoded message contains that property/field and its value is a Number (in JSON) instead of a string.

Below is a listing of the stack-trace and relevant code.

It seems that we can reliably reproduce the crash below if we let the mutate stanza work on a string with double backslashes:

Stacktrace

[no further events]

event.rb

fieldreference.rb