Input elasticsearch plugin and codec

Elastic Stack Logstash
1

Hello,
I'm trying get the raw value of %{message}, but whatever is the codec argument (in ES plugin) the result is always in json (without the field "message").

Test config:

input {
elasticsearch {
hosts => "localhost"
index => "logstash-2018.10.09"
query => '{ "query": { "query_string": { "query": "*" } } }'
size => 500
scroll => "5m"
docinfo => false
codec => "line"
}
}
output {
stdout { codec => rubydebug }
}

Is that normal?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.