Get pre-filter raw message

Elastic Stack Logstash
1

How can I get the original raw message?

I got two outputs, the first one should log the original raw log message and the second one the whole filtered stuff.
But I can't do input -> output -> filter -> output right?

So how can I log the raw text message in my first output and my modified %{message} in the second one?

2 Likes
2

There's no obvious way. What kind of outputs do you have?

3

"file" for untouched raw messages and elasticsearch

4

Okay, that's good. As your first filter, copy the message field into a subfield of @metadata. Those fields aren't sent to ES (or other output, with a few exceptions). Then adjust the message_format option of your file output to reference the saved field.

output {
  file {
    ...
    message_format => "%{[@metadata][raw_message]}"
  }
  ...
}
2 Likes
5

This is exactly what I was looking for, awesome.