How to avoid multiple escaping

Elastic Stack Logstash
1

Hi,

There is the following pipeline for Apache log:

Logstash 2.2.2

input {
  beats {
    port =>  4000
  }
}
output {
    kafka {
	topic_id => "my-topic"
	bootstrap_servers => "kafka-server"
    }
}

Kafka 0.10.0.0

Logstash 5.1.1

input {
    kafka {
	bootstrap_servers => "kafka-server"
        type => "my-type"
        topics => ["my-topic"]
    }
}
output {
    if [type] == "my-type" {
        file {
            path => "/var/log/logstash/my-type.txt"
        }
    }
}

The result is double escaping in message:

{
"@timestamp": "2016-12-12T15:23:23.894Z",
"@version": "1",
"message": "{"message":"127.0.0.1 - - 12/Dec/2016:15:15:55 +0000 \\"PUT /libs/mpick/entropology/inector.aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeeee.json HTTP/1.1\\" 200 165
...................

Where it happens and how it can be avoided?
Thanks in advance.

2

It looks like you should have codec => json set for your kafka input.

3

That is it!
Perfect!
Thanks, magnusbaeck!
(I tried "codec => json" in output.kafka before, but it did not work)

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.