Logstash syslog output message => %{_source}

[souf_el_badraoui]

Hello,
We are trying to forward windows event log shipped with winlogbeat via logstash output syslog. The problem is that we want to forward all fields (ideally key1=value1 key2=value2...) and not just the message field. We can't construct a new field concatenating all the others because we don't know which field will be available depending on the windows event log. Is it possible to use the _source field like :

Output {
  syslog{
    message => "%{_source}"
  }
}

because this field is exactly what we want to forward via syslog.
Thank you for your help !!

[Badger]

@souf_el_badraoui

We can't construct a new field concatenating all the others because we don't know which field will be available depending on the windows event log.

Actually you can do exactly that using a ruby filter

    ruby {
        init => '@ignore = [ "@metadata", "@version" ]'
        code => '
            s = ""
            event.to_hash.each { |k, v|
                unless @ignore.include?(k)
                    s = s + "#{k}=#{v},"
                end
                event.set("message", s.chomp(","))
            }
        '
    }