Logstash stdout output text as in file

[carter.kovrov (antony)]

Hi all

Tell me how to display information as in a file without additional fields?

For example, there is a file app.log with the contents

12-15-2023 app running...
12-15-2023 app login user test

necessary information was displayed in the stdout

12-15-2023 app running...
12-15-2023 app login user test

Current logstash.conf

input {
  file {
    path => "/webapp/logs/app.log"
    start_position => "beginning"
    ignore_older => 0
  }
}

filter {
  mutate {
    remove_field => [ "path", "host", "@version", "@timestamp" ]
  }
}

output {
  stdout {
    codec => plain
  }
}

1. I get all the outputs in one line
2. after removal the field "host" remains in the output %{host}

12-15-2023 app running... %{host}12-15-2023 app login user test

[Badger]

The codec, unless the format option is used, will call .to_s on the event. That is what adds %{host} and the timestamp. Try stdout { codec => plain { format => "%{message}" } }

Also, in filebeat ignore_older => 0 turns off age based filtering. In a logstash file input it causes the input to ignore any files more than zero seconds old, so it usually ignores everything.

Or you could replace logstash with /bin/cat.

[carter.kovrov (antony)]

@Badger thanks with %{host} it helped

It remains to understand how to add output to a new line

[Badger]

Are you saying there is no newline written after [message]?

[carter.kovrov (antony)]

yes, this is just my last problem

[Badger]

Insert a literal newline in the format option

stdout { codec => plain { format => "%{message}
" } }

[carter.kovrov (antony)]

@Badger thanks

Final config:

input {
  file {
    path => "/webapp/logs/app.log"
    start_position => "beginning"
    ignore_older => 0
  }
}

filter {
  mutate {
    remove_field => [ "path", "host", "@version", "@timestamp" ]
  }
}

output {
  stdout {
    codec => plain { format => "%{message}
"}
  }
}