# Logstash out put format issue

**URL:** <https://discuss.elastic.co/t/logstash-out-put-format-issue/119027>\
**Category:** Logstash\
**Created:** [February 8, 2018, 11:49am UTC](https://discuss.elastic.co/t/logstash-out-put-format-issue/119027 "2018-02-08T11:49:12Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sivaprakash\_Shanmuga](https://avatars.discourse-cdn.com/v4/letter/s/ecae2f/32.png) [@Sivaprakash\_Shanmuga](https://discuss.elastic.co/u/Sivaprakash_Shanmuga)\
**Post date:** [February 8, 2018, 11:49am UTC](https://discuss.elastic.co/t/logstash-out-put-format-issue/119027/1 "2018-02-08T11:49:12Z")

</div>

Hi,

Here is my logstash configuration

> input {  
> http {  
> host =\> "127.0.0.1"  
> port =\> 8001  
> codec =\> json  
> add\_field =\> { "raw\_message" =\> "%{message}" }  
> response\_headers =\> {  
> "Access-Control-Allow-Origin" =\> "\*"  
> "Content-Type" =\> "application/json"  
> "Access-Control-Allow-Headers" =\> "Origin, X-Requested-With, Content-Type, Accept"  
> }  
> }  
> }
> 
> output {  
> stdout { codec =\> rubydebug }  
> }

Input from Postman

> {  
> "role":"ROLE\_ADMIN",  
> "id":34  
> }

Output which I see on terminal as below

> "id" =\> 34,  
> "host" =\> "127.0.0.1",  
> "raw\_message" =\> "%{message}",  
> "role" =\> "ROLE\_ADMIN",  
> "headers" =\> {  
> "http\_origin" =\> "chrome-extension://fhbjgbiflinjbdggehcddcbncdddomop",  
> "http\_version" =\> "HTTP/1.1",  
> "http\_cache\_control" =\> "no-cache",  
> "content\_type" =\> "application/json",  
> "http\_accept\_language" =\> "en-US,en;q=0.9",  
> "http\_postman\_token" =\> "ec076902-5473-0af0-de04-3350961c3481",  
> "http\_user\_agent" =\> "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_12\_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36",  
> "http\_accept" =\> "_/_",  
> "http\_connection" =\> "keep-alive",  
> "request\_method" =\> "POST",  
> "request\_path" =\> "/token",  
> "request\_uri" =\> "/token",  
> "content\_length" =\> "65",  
> "http\_accept\_encoding" =\> "gzip, deflate, br",  
> "http\_host" =\> "localhost:8001"  
> },  
> "@timestamp" =\> 2018-02-08T11:21:43.020Z,  
> "@version" =\> "1",

I dont get my in put JSON inside message (I see them individual property) However, If I pass values through Curl command I'm able to see message with exact json which Im passing.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 8, 2018, 12:31pm UTC](https://discuss.elastic.co/t/logstash-out-put-format-issue/119027/2 "2018-02-08T12:31:25Z")

</div>

So you _don't_ want Logstash to parse the JSON for you? Change from the json codec to plain in the http input plugin.

---

<div class="post-metadata">

**Author:** ![Sivaprakash\_Shanmuga](https://avatars.discourse-cdn.com/v4/letter/s/ecae2f/32.png) [@Sivaprakash\_Shanmuga](https://discuss.elastic.co/u/Sivaprakash_Shanmuga)\
**Post date:** [February 8, 2018, 2:07pm UTC](https://discuss.elastic.co/t/logstash-out-put-format-issue/119027/3 "2018-02-08T14:07:11Z")

</div>

> [@Sivaprakash\_Shanmuga](#):
>
> codec =\> json

I want logstash to process JSON., I want to write the Body (Paload) into Elasticsearch. But I do not get message JSON here. How to get it?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 8, 2018, 3:20pm UTC](https://discuss.elastic.co/t/logstash-out-put-format-issue/119027/4 "2018-02-08T15:20:18Z")

</div>

Logstash will take the whole event and turn it into JSON before shipping it to Elasticsearch. What you have in your example above looks fine and I think you've misunderstood what Logstash does.

---

<div class="post-metadata">

**Author:** ![Sivaprakash\_Shanmuga](https://avatars.discourse-cdn.com/v4/letter/s/ecae2f/32.png) [@Sivaprakash\_Shanmuga](https://discuss.elastic.co/u/Sivaprakash_Shanmuga)\
**Post date:** [February 8, 2018, 3:27pm UTC](https://discuss.elastic.co/t/logstash-out-put-format-issue/119027/5 "2018-02-08T15:27:34Z")

</div>

Yes I misunderstood it.  
So is there any way i can extract only Payload data and write it into Elasticsearch? Filter would help?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 8, 2018, 4:24pm UTC](https://discuss.elastic.co/t/logstash-out-put-format-issue/119027/6 "2018-02-08T16:24:50Z")

</div>

Yes, the mutate filter can delete unwanted fields.

---

<div class="post-metadata">

**Author:** ![Sivaprakash\_Shanmuga](https://avatars.discourse-cdn.com/v4/letter/s/ecae2f/32.png) [@Sivaprakash\_Shanmuga](https://discuss.elastic.co/u/Sivaprakash_Shanmuga)\
**Post date:** [February 8, 2018, 4:41pm UTC](https://discuss.elastic.co/t/logstash-out-put-format-issue/119027/7 "2018-02-08T16:41:56Z")

</div>

Thank you ., it works

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2018, 4:42pm UTC](https://discuss.elastic.co/t/logstash-out-put-format-issue/119027/8 "2018-03-08T16:42:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.