Logging to Logstash JSON Format in Nginx

So if I set my user-agent to "}, what would Logstash do?

If there's no explicit JSON support when coercing user data into JSON, be very careful that you don't produce something that looks like JSON but isn't.

Or in other words: In this specific case I'd recommend just emitting normal combined log format because there's already support for that in logstash and that support is explicitly made to be tolerant of dirty data, whereas I would suppose their JSON support isn't (either it's JSON or it's not, but who knows in what strange ways a webserver could encode their access log)