Hello,
I am using logstash 7.3.1.
I use an http input plugin to get data into logstash. I get an JSON payload which looks like
{"version":"1.1","host":"myHost","short_message":"Test Dev","full_message":"Testlog Message for Elastic","level":1,"_server_name":"localhost","_server_ip":"127.0.0.1","_server_apppool":"FSCPool","_user_id":"xx\\yyyy","_coo_env":"123456","_level_name":"INFO","_url_args":"&cx=Y52EHGmnn-PiUVV2&tz=-60&xhr=1"}
Based on the attribute "host" in the Json I have to do some logic, the problem seems that the input plugin already provides a field named "host".
In case I use the json plugin as followed, the information from the input json (except the host attribute) is available. The host field still contains the value from the http input.
json {
source => "message"
}
I came accross the target parameter in the json plugin
json {
source => "message"
target => "parsed_json"
}
As it is indicated in the documentation the parsed information should not be placed in the root but in the "parsed_json".
Basically the json is parsed correctly (except the host) but all information are placed in the root and not in "parsed_json"
Is there something I have overlooked or did I missunderstood something?
Beside the issue with the target - is there another solution for my duplicate host problem?
I also tried to remove, rename,... the host field from the input but nothing changed.
Thanks in advance for your help
Regards