How to split a message from rabbit?

Elastic Stack Logstash
1

Hi!
I am trying to split this message:

{"test": "Test"}
{"test": "Test2"}

into two messages using this simple config:

input {                                                                    
    rabbitmq {                                                           
        host => "192.168.68.112"                                     
        queue => "TEST"                                                   
        user => "guest"
        password => "guest"
        durable => true                                                     
    }                 
}                                                          
filter {    
    split { }                                                             
}                      
output { stdout {} }

But I get this error:
Only String and Array types are splittable. field:message is of type = NilClass

Is there a way to treat the input as raw string, split it to two messages using the line break and transform it back to json?

2

What is your output?

You need to share how Logstash is receiving in what is the output you are getting to try to understand why the split is not working.

3

The default codec for a rabbitmq is json. Unless your JSON includes a message field it will not exist and you will get that error. What does an event look like if you use

output { stdout { codec => rubydebug } }
4

This is the output:

{
          "test" => "TEST",
      "@version" => "1",
    "@timestamp" => 2022-12-12T20:34:29.334542694Z,
         "event" => {
        "original" => "{\"test\": \"TEST\"}\r\n{\"test\": \"TEST2\"}"
    }
}

Thank you for the quick replay!

5

I found I should use codec => "json_lines" and it splits the message
But now I found another problem, if the last line doesn't have a line break at the end, it ignores it

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.