Hi Team, I have small query here.
I am sending json messag on Kafka queue and indexing the same in Elasticsearch. It is inserting properly but all the fields are storing with message.field extension. Is there any parameter do i need to include in the logstash config file to remove this message. extension.
logsstash config file -
input {
kafka {
bootstrap_servers => "XX.XX.XX.XX:9092"
topics => ["logmes"]
}
}
filter {
json {
source => "message"
}
}
output {
elasticsearch {
hosts => "https://XX.XX.XX.XX:9200"
index => "tibco-app-logs"
user => "elastic"
password => "XXXXXXXXX"
cacert => "/etc/logstash/elk-stack.crt.pem"
ssl_certificate_verification => false
}
}
Elasticsearch data -