How to debug log entries which just contain "%{host} %{message}" solved!

Elastic Stack Logstash
1

I configured logstash to updload to s3. When I check the files on s3, they are full of entries like this:
2016-05-09T23:27:31.811Z %{host} %{message}
2016-05-09T23:27:31.811Z %{host} %{message}
2016-05-09T23:27:31.809Z %{host} %{message}
2016-05-09T23:27:31.810Z %{host} %{message}
2016-05-09T23:27:31.827Z %{host} %{message}
2016-05-09T23:27:31.828Z %{host} %{message}

how to debug what's creating such messages? How to remove them?

When I change the output from s3 to "file" I don't see those messages in the output file

2

What do your messages actually look like? Use a stdout { codec => rubydebug } output to get a raw dump.

3

Since I use a managed service to run log stash, I used the debug codec in the file output.
None of the messages contain just %{host} %{message}

It seems to be only in the s3 output.

the content of the messages is confidential, so is it possible to dm you?

4

I don't offer private support so please try to find a way to obfuscate the confidential parts. But anyway, you're using the default plain codec for the s3 output. You'll want to use json_lines instead or possibly some other codec that produces logs in a format that keeps all fields.

5

Adding the json_lines codec seems to work.
Why doesn't the s3 output plugin work by default? why does it need that codec field defined?

6

Well, not everyone wants JSON logs. Having it default to the plain codec maybe wasn't the wisest decision when the plugin was introduced, but changing that default now would be somewhat painful.