How to force/change the order of the fields in a event?

Elastic Stack Logstash
1

Hi,

It is possible (or how can it be done) to force/change the order of the fields in a event?

The reason for my question is simple:
I have a field "_time" in my events that I need to be the very first field in my JSON events.
I need to either sort the fields (causing the "_time" to come first) or move that field to the first position in the event.

It seems a somewhat strange question, but this is due to the fact the event will be output via tcp, and field "_time" needs to come first in the JSON event in order to be correctly processed (setting the timestamp of the event).

Thanks.

2

It is possible (or how can it be done) to force/change the order of the fields in a event?

No, sorry. The order of the fields is undefined and can't be relied on.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.