Json message storing with message. extension in index

Hi Team, I have small query here.
I am sending json messag on Kafka queue and indexing the same in Elasticsearch. It is inserting properly but all the fields are storing with message.field extension. Is there any parameter do i need to include in the logstash config file to remove this message. extension.

logsstash config file -

input {
    kafka {
      bootstrap_servers => "XX.XX.XX.XX:9092"
          topics => ["logmes"]
    }
}

filter {

        json {
                source => "message"
             }
         }


output {
  elasticsearch {
    hosts => "https://XX.XX.XX.XX:9200"
    index => "tibco-app-logs"
    user => "elastic"
    password => "XXXXXXXXX"
    cacert => "/etc/logstash/elk-stack.crt.pem"
    ssl_certificate_verification => false
  }
}

Elasticsearch data -
image

Since you have not given any indication what you JSON structure is, it is impossible to say.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.