elastic / elastic/logstash

Unable to easily remove the source message field

Open
#6,101 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

I apologise if I am filing this issue on the wrong repository, but I don't think that this issue is unique to [logstash-filter-json](https://github.com/logstash-plugins/logstash-filter-json). Basically, what I am trying to do is parse a JSON-encoded message and then remove the JSON-encoded field. Ideally, I would be able to achieve this with the following configuration:

```
filter {
json {
remove_field => ["message"]
source => "message"
}
}
```

This works if the JSON-encoded message doesn't contain a `message` field itself, but if it does then the wrong field is removed from the event. I was able to work around this by using the following configuration instead, but this feels hacky:

```
filter {
if [type] == "json" {
mutate {
add_field => {
"[@metadata][message]" => "%{message}",
}
remove_field => ["message"]
}

json {
source => "[@metadata][message]"
}
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.