How to refer to the whole modified event inside http output plugin

I am trying to map my http payload and put the whole Logstash event inside another json key/field:

http {
  format      => "json"
  http_method => "post"
  url         => "some url"
  headers     => ["some header"]
  mapping     => {
    "field 1" => "value 1"
    "field 2" => "value 2"
    "event"   => "I want my whole event to be exploded here, how can I do that? I tried %{source}, %{data} both don't work - how can I do this? "
  }
}

If you really want the whole event (as a hash) then try

filter { ruby { code => 'event.set("[@metadata][event]", event.to_hash)' } }
output { http { mapping => { "event" => "%{[@metadata][event]}" ...

That worked! Huge thanks to you Mr @Badger, you are the best mustelid in the world!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.