Netflow codec output to the root of the message

Elastic Stack Logstash
#1

I'm testing the netflow codec to receive some netflow data, but I don't want the output to be inside of a nested field, I would prefer it to be on the root of the message.

I've tried setting the field config of the codec to "message" or "@message" but that doesn't work. Is there any way to have the codec write the fields directly to the root of the message instead of a nested field?

#2

Anyone?

#3

Just in case anyone is interested, I was able to get the desired result using json_enconde and the json filters. Seems like a waste of resources but I don't know enough ruby to be able to modify the filter myself.

input {
  udp {
  port => 9996
  codec => netflow {
    target => netflow_field
    }
  }
}

filter {
  json_encode {
    source => netflow_field
  }
  json {
    source => netflow_field
    remove_field => [ "netflow_field" ]
  }
}


output {
  stdout {
    codec => rubydebug
  }
}
#4