Logstash syslog output message => %{_source}

We are trying to forward windows event log shipped with winlogbeat via logstash output syslog. The problem is that we want to forward all fields (ideally key1=value1 key2=value2...) and not just the message field. We can't construct a new field concatenating all the others because we don't know which field will be available depending on the windows event log. Is it possible to use the _source field like :

Output {
    message => "%{_source}"

because this field is exactly what we want to forward via syslog.
Thank you for your help !!

Actually you can do exactly that using a ruby filter

    ruby {
        init => '@ignore = [ "@metadata", "@version" ]'
        code => '
            s = ""
            event.to_hash.each { |k, v|
                unless @ignore.include?(k)
                    s = s + "#{k}=#{v},"
                event.set("message", s.chomp(","))
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.