Event.get("message") & http input - where is the message?

Elastic Stack Logstash
1

Hi,

I'm creating a new plugin that writes events to google pub sub.
I don't understand the behavior of "message" when using http input.

I tried using stdin input & I can see the content of the message when I execute this ruby code:
puts event

for example I'm getting:
2017-02-22T01:12:26.612Z XXX-server-01 abcdef
(abcdef is my message)

and I also can extract the message with code: event.get("message").

However, when I use http input:
input {
http {
host => "XXX-server-01.domain123.corp"
port => 8080
}
}

I get for the puts command:
2017-02-22T01:09:46.708Z 10.105.11.17 %{message}
I don't understand the behavior, how should I extract the actual message?
When I run puts event.get("message") I get nothing.

Thanks!

2

Use a stdout { codec => rubydebug } output to see exactly what the event looks like. I'm guessing that the content type of the HTTP POST operation is application/json, which will make Logstash decode the posted data as JSON. If the data doesn't have a message field your event won't get a message field and therefore event.get("message") returns nil.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.