# Event.get("message") & http input - where is the message?

**URL:** https://discuss.elastic.co/t/event-get-message-http-input-where-is-the-message/76000
**Category:** Logstash
**Created:** [February 22, 2017, 8:52am UTC](https://discuss.elastic.co/t/event-get-message-http-input-where-is-the-message/76000 "2017-02-22T08:52:56Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![NirKa](https://avatars.discourse-cdn.com/v4/letter/n/e36b37/32.png) [@NirKa](https://discuss.elastic.co/u/NirKa)
#### Post date: [February 22, 2017, 8:52am UTC](https://discuss.elastic.co/t/event-get-message-http-input-where-is-the-message/76000/1 "2017-02-22T08:52:56Z")

</div>

Hi,

I'm creating a new plugin that writes events to google pub sub.  
I don't understand the behavior of "message" when using http input.

I tried using stdin input & I can see the content of the message when I execute this ruby code:  
`puts event`

for example I'm getting:  
2017-02-22T01:12:26.612Z XXX-server-01 **abcdef**  
(abcdef is my message)

and I also can extract the message with code: event.get("message").

However, when I use http input:  
input {  
http {  
host =\> "XXX-server-01.domain123.corp"  
port =\> 8080  
}  
}

I get for the puts command:  
2017-02-22T01:09:46.708Z 10.105.11.17 **%{message}**  
I don't understand the behavior, how should I extract the actual message?  
When I run puts event.get("message") I get nothing.

Thanks!

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 23, 2017, 6:44am UTC](https://discuss.elastic.co/t/event-get-message-http-input-where-is-the-message/76000/2 "2017-02-23T06:44:49Z")

</div>

Use a `stdout { codec => rubydebug }` output to see exactly what the event looks like. I'm guessing that the content type of the HTTP POST operation is application/json, which will make Logstash decode the posted data as JSON. If the data doesn't have a `message` field your event won't get a `message` field and therefore event.get("message") returns nil.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 23, 2017, 6:44am UTC](https://discuss.elastic.co/t/event-get-message-http-input-where-is-the-message/76000/3 "2017-03-23T06:44:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.