# Logstash 8.0 is adding extra field **URL:** \ **Category:** Logstash\ **Created:** [February 18, 2022, 10:42am UTC](https://discuss.elastic.co/t/logstash-8-0-is-adding-extra-field/297594 "2022-02-18T10:42:52Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![kannan\_raj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kannan_raj/32/63201_2.png) [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Post date:** [February 18, 2022, 10:42am UTC](https://discuss.elastic.co/t/logstash-8-0-is-adding-extra-field/297594/1 "2022-02-18T10:42:52Z")
logstash consuming JSON messages from Kafka and indexing them into Elasticsearch. we found that logstash version 8.0 is adding the additional field event with the value of the actual message. could you please let me know how to ignore the field event without using mutate filter? actual message is ```auto { "name": "test" } ``` Doc indexed into Elasticsearch from logstash version 8.0 ```auto { "_index" : "test-2022.02.15-000001", "_id" : "3-eHC38BJKmKsTb9eGMU", "_score" : 1.0, "_source" : { "name" : "test", "@version" : "1", "event" : { "original" : "{\"name\": \"test\"}" }, "@timestamp" : "2022-02-18T06:31:41.467701Z" } ``` Doc indexed into Elasticsearch from logstash version 7.16.2 ```auto { "_index" : "test-2022.02.15-000001", "_id" : "4OeKC38BJKmKsTb9xWPN", "_score" : 1.0, "_source" : { "@timestamp" : "2022-02-18T06:35:18.018Z", "name" : "test", "@version" : "1" } } ``` configuration ```auto input { kafka { bootstrap_servers => ["hostname:9093"] topics => ["acl"] ssl_keystore_password => "changeme" ssl_truststore_password => "changeme" ssl_keystore_location => "/opt/logstash/ssl/keystore.jks" ssl_truststore_location => "/opt/logstash/ssl/truststore.jks" security_protocol => "SSL" client_id => "client" group_id => "group" enable_auto_commit => "true" auto_offset_reset => "latest" check_crcs => "false" decorate_events => true consumer_threads => "1" codec => "json" } } output { elasticsearch { hosts => ["https://hostname:9200"] user => "user" password => "password" ilm_enabled => true ilm_rollover_alias => "alias" ilm_policy => "ilm" ssl => true cacert => "ca.pem" ssl_certificate_verification => true manage_template => false } } ``` logstash.yml ```auto node.name: hostname path.data: /data/logstash config.reload.automatic: True config.reload.interval: 30 queue.type: persisted path.queue: /data/logstash/queue queue.page_capacity: 500mb queue.max_events: 0 queue.max_bytes: 1gb queue.checkpoint.acks: 0 queue.checkpoint.writes: 0 queue.checkpoint.interval: 0 http.host: 127.0.0.1 http.port: 9600 log.level: info path.logs: /data/logs/logstsah ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 18, 2022, 1:35pm UTC](https://discuss.elastic.co/t/logstash-8-0-is-adding-extra-field/297594/2 "2022-02-18T13:35:35Z")
It seems to be related to the [ecs compatibility](https://www.elastic.co/guide/en/logstash/current/ecs-ls.html#ecs-configuration-pipeline) as `event.original` is an ecs field. Try to set `pipeline.ecs_compatibility: disabled` for your pipeline in `pipelines.yml` or for all pipelines putting the setting in `logstash.yml`. ---
**Author:** ![grants](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grants/32/117040_2.png) [@grants](https://discuss.elastic.co/u/grants)\ **Post date:** [March 4, 2022, 3:39pm UTC](https://discuss.elastic.co/t/logstash-8-0-is-adding-extra-field/297594/3 "2022-03-04T15:39:42Z")
Leaving `pipeline.ecs_compatibility` as default will enable this in version 8 of logstash. Older versions this wasn't enabled by default. If you set `pipeline.ecs_compatibility: disabled` globally it seems to fix this issue, but if it's left default and disabled for all plugins at the pipeline, it still seems to populate this value. I wish there was some documentation on this, why it's here, and what other fields logstash adds by default. Tested: logstash-6.8.23 (off by default) logstash-7.17.1 (off by default) logstash-8.0.1 (on by default) To further test how this gets added or what plugin is to blame, I disabled the setting globally and enabled it on each plugin but this field didn't show up. Honestly pretty strange behavior. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 4, 2022, 3:50pm UTC](https://discuss.elastic.co/t/logstash-8-0-is-adding-extra-field/297594/4 "2022-03-04T15:50:19Z")
The `pipeline.ecs_compatiblity` being enabled as default in version 8 is on the list of [breaking changes](https://www.elastic.co/guide/en/logstash/current/logstash-8-0-0.html#breaking-8.0.0). > - Many plugins can now be run in a mode that avoids implicit conflict with the Elastic Common Schema (ECS). This mode is controlled individually with each plugin’s ecs\_compatibility option, which defaults to the value of the Logstash pipeline.ecs\_compatibility setting. **In Logstash 8, this compatibility mode will be on-by-default for all pipelines.** If you wish to lock in a pipeline’s behavior from Logstash 7.x before upgrading to Logstash 8, you can set `pipeline.ecs_compatibility: disabled` to its definition in `pipelines.yml` (or globally in `logstash.yml` ). Also, some plugins have the information of the names of the fields it creates with the ecs compatibility on and off, for example the [file input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-ecs) and the [http input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http.html#plugins-inputs-http-ecs_metadata), but I'm not sure if the documentation for every plugin has this information yet. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 1, 2022, 3:50pm UTC](https://discuss.elastic.co/t/logstash-8-0-is-adding-extra-field/297594/5 "2022-04-01T15:50:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.