How do I stringify entire event object in logstash and put it in one field

[ghanshyam_baviskar]

I am trying to implement a dead letter queue pipeline, I want to take entire event , stringify it and put it into a field "strigified_event". so that it can be monitored for elasticsearch mapper errors

input {
  dead_letter_queue {
    path => "/home/light/development/repo/logstash/logstash-7.11.0/data/dead_letter_queue"
    commit_offsets => true 
    pipeline_id => "p-logs"
  }

  dead_letter_queue {
    path => "/home/light/development/repo/logstash/logstash-7.11.0/data/dead_letter_queue"
    commit_offsets => true 
    pipeline_id => "p-transactions"
  }
}



output {
  elasticsearch {
    hosts => [ "localhost:9200" ]
    index => "deadletterqueue-%{+YYYY.MM.dd}"
    action => "create"
  }

  stdout {
    codec => "rubydebug"
  }
  
}

[sholzhauer]

I think something like this could work;

filter {
  ruby  {
    code => "event.set(\"stringified_event\", event)" 
  }
  mutate  {
    convert => {"stringified_event" => " string" }    
  }
}

In this "pseudo" code i am using ruby to create a new event with the entire event in it. Then I use mutate to convert it to a string.

Keep in mind this will keep everything around it too.

[ghanshyam_baviskar]

I tried this, but this is giving following error:

[2023-10-21T15:04:14,562][ERROR][logstash.filters.ruby    ][dlq-pipeline][ceac6b40d2466837847c74300de9b46d022d4a7e2aa3091bc528f747c702c877] Ruby exception occurred: undefined method `[]' for #<LogStash::Event:0x6548fcaf>

[Rios]

Try:

  ruby  {
    code => "event.set( 'stringified_event', event.get('[event][original]') )" 
  }

[leandrojmp (Leandro Pereira)]

Can you share what is the output you are getting and what is the output you want? You didn't provide any information about this.

According to the documentation the dead_letter_queue input you will already have the entire event as a string in the message field.