Logstash output file plugin adds automatically hostname

[tusharnemade]

Hello

I am using Logstash version 7.8.0.

I am having my configuration as input is logstash-plain.log file which is its logfile.

It does not contain hostname , on its line, while logstash when processing data to output file , it adds hostname from where its running. I want to avoid this hostname in output file.

input {
    file {
        path => "/usrdata/logstash/logs/logstash-plain.log"
        start_position => "beginning"
        sincedb_path => "/dev/null"
        mode => ["tail"]
    }
}


filter {
    mutate {
        remove_field => ["host" , "@version", "@timestamp", "path"]
    }
}


output {
    if "ERROR" in [message] {
        file {
            codec => "line"
            path => "/usrdata/logstash/logs/chk_logstash_alertlog.log"
        }
    }
}

The output of the above config is

my-dbvm-for-poc-01 [2022-06-01T08:12:36,889][ERROR][org.logstash.execution.WorkerLoop][check_logstash_logfile_for_errors] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.

Output contains hostname "my-dbvm-for-poc-01" . I do not want this hostname to come ..

Could you please help me .

[tusharnemade]

sometime it comes as

%{host} [2022-06-01T08:12:36,889][ERROR][org.logstash.execution.WorkerLoop][check_logstash_logfile_for_errors] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.

[tusharnemade]

Okay , I was able to achieve same using

output {
    if "ERROR" in [message] {
        file {
            codec => line { format => "%{message}" }
            path => "/usrdata/logstash/logs/chk_logstash_alertlog.log"
        }
    }
}