Logstash Integration Plugin configuration option field issue (Logstash Input Plugin add_filed issue)

[siva0030 (sivakumar)]

Hello Team,
Good noon!

Recently, I've upgraded my Logstash to 8.11.3 version. Starting from Logstash 8.11 version, Logstash Integration Plugin is available. I was trying to use the Logstash input plugin to receive the data from another Logstash.

as per the elastic documentation, we can use the ** add_field** and id in the logstash input plugin and that will add the filed to the every event.

But, add_filed and Id is not getting added in the event. Here attaching my logstash config, could you please someone check and help me to resolve this issue?

Elastic documentation link: Logstash input plugin | Logstash Reference [8.12] | Elastic

Logstash config:

input {
    logstash {
      port => 9801
      host => "0.0.0.0"
      ssl_enabled => false
      id => "logstash-0"
      add_field => { 
          "from_other_logstash" => "yes"
      }
    }
}
filter {
    mutate {
      add_field => {
       "data_coming_from" => "Logstash-8"
      }
    }
}
output {
    stdout {
        codec => rubydebug {
            metadata => true
        }
    }
}

Thanks
Siva

[siva0030 (sivakumar)]

Hi Team,

One more observation, Adding tags is also not working in the Logstash input plugin. Can someone please help resolve this issue?

Find the input config below.

input {
    logstash {
      port => 9801
      host => "0.0.0.0"
      ssl_enabled => false
      id => "logstash-0"
      add_field => { 
          "from_other_logstash" => "yes"
      }
     tags => ["logstashData"] 

    }
}

thanks in advance!
Siva

[leandrojmp (Leandro Pereira)]

Just tested here and it also does not add the fields or tags, you will need to open an github issue.

Or this is a bug, or the documentation is wrong and the common options does not work in this case.

This is the repo for this input/output.

[Badger]

You are right, the input does not call decorate, so the common options like add_field do not work. An issue for this was opened this morning.

The id option does not add an [id] field to the event, it is used by the pipeiine stats API to tell you which plugin the stats refer to. Useful if you have more than one plugin of the same type.