# Gathering RabbitMQ payload when it has a filed message

**URL:** <https://discuss.elastic.co/t/gathering-rabbitmq-payload-when-it-has-a-filed-message/194009>\
**Category:** Logstash\
**Created:** [August 6, 2019, 12:37pm UTC](https://discuss.elastic.co/t/gathering-rabbitmq-payload-when-it-has-a-filed-message/194009 "2019-08-06T12:37:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pszemesy](https://avatars.discourse-cdn.com/v4/letter/p/e8c25b/32.png) [@pszemesy](https://discuss.elastic.co/u/pszemesy)\
**Post date:** [August 6, 2019, 12:37pm UTC](https://discuss.elastic.co/t/gathering-rabbitmq-payload-when-it-has-a-filed-message/194009/1 "2019-08-06T12:37:17Z")

</div>

Hi All,

I'm trying to store the original RabbitMQ payload to orig\_msg field with Logstash, but the payload itself contains a filed called message. Logstash add\_field mutate { add\_field =\> { "orig\_msg" =\> "%{message}" } } crates the orig\_msg filed with the value in the message field within the payload. How can I store the original payload in the orig\_msg filed?

_My Logstash pipeline:_

> ```
> input {
> rabbitmq {
> host => ["rabbitmq.xyz.local"]
> queue => "queue_1"
> heartbeat => 30
> durable => true
> password => "password"
> user => "user"
> }
> }
> filter {
> mutate {
> add_field => { "orig_msg" => "%{message}" }
> }
> 
> if [@metadata][rabbitmq_properties][timestamp] {
> date {
> match => ["[@metadata][rabbitmq_properties][timestamp]", "UNIX"]
> }
> }
> 
> }
> output {
> elasticsearch {
> hosts => "localhost:9200"
> index => "index_1"
> user => "elastic_user"
> password => "password"
> }
> 
> stdout {
> codec => rubydebug { metadata => true }
> }
> } 
> 
> ```

_The test payload:_  
`{"time":"2019-07-09T11:04:04.944+0200", "severity": "INFO", "service": "agent-test", "trace": "", "span": "", "parent": "", "exportable": "", "pid": "5760", "thread": "main", "class": "", "method": "", "evaluationTime": "", "message": "The following profiles are active: test", "params": "", "headers": ""}`

Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 6, 2019, 1:36pm UTC](https://discuss.elastic.co/t/gathering-rabbitmq-payload-when-it-has-a-filed-message/194009/2 "2019-08-06T13:36:56Z")

</div>

The default codec in a rabbitmq input is json, so the json is parsed by the time the event is flushed to the pipeline. You could try changing the input codec to line or plain to prevent it parsing the data and then add a json filter.

---

<div class="post-metadata">

**Author:** ![pszemesy](https://avatars.discourse-cdn.com/v4/letter/p/e8c25b/32.png) [@pszemesy](https://discuss.elastic.co/u/pszemesy)\
**Post date:** [August 6, 2019, 2:05pm UTC](https://discuss.elastic.co/t/gathering-rabbitmq-payload-when-it-has-a-filed-message/194009/3 "2019-08-06T14:05:01Z")

</div>

And how can I do that? - Done (with Codec)  
Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 6, 2019, 2:44pm UTC](https://discuss.elastic.co/t/gathering-rabbitmq-payload-when-it-has-a-filed-message/194009/4 "2019-08-06T14:44:11Z")

</div>

Add

```
codec => plain

```

to the options on the rabbitmq input.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2019, 2:44pm UTC](https://discuss.elastic.co/t/gathering-rabbitmq-payload-when-it-has-a-filed-message/194009/5 "2019-09-03T14:44:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.