Unable to easily remove the source message field
- Dominant language
- Java
- Stars
- 14.9k
- Forks
- 3.5k
- Avg merge
- 19h 14m
- Merged PRs (30d)
- 63
Description
I apologise if I am filing this issue on the wrong repository, but I don't think that this issue is unique to [logstash-filter-json](https://github.com/logstash-plugins/logstash-filter-json). Basically, what I am trying to do is parse a JSON-encoded message and then remove the JSON-encoded field. Ideally, I would be able to achieve this with the following configuration:
```
filter {
json {
remove_field => ["message"]
source => "message"
}
}
```
This works if the JSON-encoded message doesn't contain a `message` field itself, but if it does then the wrong field is removed from the event. I was able to work around this by using the following configuration instead, but this feels hacky:
```
filter {
if [type] == "json" {
mutate {
add_field => {
"[@metadata][message]" => "%{message}",
}
remove_field => ["message"]
}
json {
source => "[@metadata][message]"
}
}
}
```
Contributor guide
Assessment
This issue has not been assessed yet.