Remove N leading bytes from TCP input

Elastic Stack Logstash
1

Hi,

We are receiving some dubious Protobuf-encoded messages on our TCP input.
The sender is leading with a custom length-header of 4 bytes.

If we manually dissect the messages, remove the first 4 bytes, and then give them to the input plugin with a protobuf codec, it works.
So, we want to receive the message in one pipeline, remove the first 4 bytes, and then pass them on to the regular protobuf-decoding pipeline.

Is the Ruby filter the correct way to do this?

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.