I upgraded logstash to Version 2.3. (Shipper, Indexer is 2.2.)
Did not changed anything in my config, but the output on the Indexer is different.
Shipper Config:
input {
file {
type => "log4j"
path => ...
start_position => beginning
sincedb_path => null
}
}
output
redis {
host => ["***"]
port => 6379
data_type => "list"
key => "logstash"
codec => plain { charset => "ISO-8859-1" }
}
Indexer config
input {
redis {
host => "127.0.0.1"
port => 6379
data_type => "list"
key => "logstash"
}
}
output {
stdout{}
}
if I start the shipper with 2.2. everythings fine.
here are the different outputs from indexer
2.2.:
2016-04-11T08:26:37.705Z SERVERNAME MESSAGE
2.3:
2016-04-11T10:36:37.705Z %{host }2016-04-11T08:26:37.705Z SERVERNAME MESSAGE
Outputs from Shipper are the same in 2.2. and 2.3.
Why does Logstash create two timestamps and whats %{host}?
Is something new with the codec-configuration?