How do I configure line codec to output plain events?

Elastic Stack Logstash
1

Hello,

I assumed that the plain and line plugins would output the event message unmodified, but this does not appear to be the case, as a bunch of "garbage" data I don't care about is prepended to the event.

2021-07-15 13:04:42 INFO dev-app: Log message...

becomes

2021-07-15T13:04:42.929Z {hostname=prod-system-filebeat-filebeat-4vhtf, os={kernel=4.18.0-305.3.1.el8.x86_64, codename=Core, name=CentOS Linux, type=linux, family=redhat, version=7 (Core), platform=centos},.[ and lots of more mostly useless data... ]} 2021-07-15 13:04:42 INFO dev-app: Log message...

It would seem like this is configurable by the format option to the line plugin, but I can't find any documentation describing either what the default is, the expected format, or where this option is expected to be added. It doesn't appear like the output plugins actually accepts a format option?

2

The default for both the plain and line codecs is to call event.to_s if no format is supplied. This will prepend the timestamp and hostname.

If you just want to write the message then use

output { someOutput { codec => line { format => "%{message}" } } }
3

I didn't realize that the codec option could be a hash itself, but this solved it!

Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.