Logstash applying json filter on all messages in filter when I did not apply it

Elastic Stack Logstash
1

I have a pipeline that looks like the below, for some reason I still get

[2022-12-06T17:30:17,641][ERROR][logstash.codecs.json     ][main] [f764d264.....] JSON parse error, original data now in message field ...........

in the console and _jsonparsefailure added to the "tags" field when I have not applied the json filter at all. Is this normal? How can I remove the forced json filter application, if that is what it is?

input {
   rabbitmq {
     queue => "q1"
     host => "localhost"
     password => "guest"
     durable => "true"
      }
}

filter {
      grok {
         match => {
               "message" => "%{TIMESTAMP_ISO8601:datetime} %{IP:ip}"
         }
         add_tag => "extra_tag"
      }
}
output {
        if "extra_tag" in [tags] {
        stdout {}
}}

Thanks.

2

okay, it is related to codec.
I solved the issue by adding codec => "plain" to my input

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.