Hi,
I would like to see the metadata of my rabbitmq input.
I have set metadata_enabled to true
and then i added this :
add_field => { "topic" => "%{[@metadata][rabbitmq_properties][routing-key]}"}
Unfortunately I end up with a string field "topic" = %{[@metadata ][rabbitmq_properties][routing-key]}
How can I retrieve the information ?
Thanks
I have tested the configuration with rubydebug, and there is no metadata in the output. I guess the problem come from this.
Here is my config
input {
rabbitmq {
host => "x.x.x.x"
subscription_retry_interval_seconds => 5
exchange => "amq.topic"
key => "#"
auto_delete => "true"
user => "x"
password => "x"
metadata_enabled => "true"
#add_field => { "topic" => "%{[@metadata][rabbitmq_properties][routing-key]}"}
}
}
filter {
split {
field => "metrics"
terminator => "},"
}
mutate {
rename => {"[metrics][dataType]" => "metrics_datatype"}
rename => {"[metrics][name]" => "metrics_name"}
rename => {"[metrics][timestamp]" => "metrics_timestamp"}
rename => {"[metrics][value]" => "metrics_value"}
}
if [metrics_datatype] == "float" {
ruby {
code => 'event.set(event.get("metrics_name") + "_value", event.get("metrics_value").to_f)'
}
}
}
output {
stdout {codec => rubydebug {metadata => true}}
}
here is the output (no metadata)
"@timestamp" => 2017-09-22T09:42:50.840Z,
"metrics_value" => "7.5",
"metrics_datatype" => "float",
"@version" => "1",
"metrics_name" => "PH",
"metrics" => {},
"metrics_timestamp" => "2017-09-22T09:42:50.821Z",
"PH_value" => 7.5,
"timestamp" => "2017-09-22T09:42:50.821Z",
"tags" => []
magnusbaeck
(Magnus Bäck)
September 22, 2017, 11:16am
3
Which version of Logstash and which version of the rabbitmq input plugin?
Hi,
I just figured out the problem.
I had to use "plain" codec in the input section.
Then the metadata are here.
I used a json filter after that to read the message in the filter section.
WIth json codec or if no codec is set, metadata don't appear.
system
(system)
Closed
October 20, 2017, 11:19am
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.