Keep original log message when using Syslog input
Open
[zube]: Inbox
enhancement
Filebeat
Team:Integrations
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 364
Description
**Describe the enhancement:**
When using the syslog input the original message is not stored in log.original. As processors run after the input parsing is completed you cannot use copy_field to get the original message back.
**Describe a specific use case for the enhancement or feature:**
Allow for reprocessing of syslogs in the future and allow for viewing the entire original log message.
Contributor guide
Assessment
This issue has not been assessed yet.