Shipping access logs logstash to logstash using http plugins

Elastic Stack Logstash
1

Hi

We have a setup where we ship logs between systems via logstash to logstash using http plugins. The access logs are in ecs format. The problem is, logstash overwrites http, url and others fields, with it's own transport information. Can this be solved without renaming original fields before sending, and then again after receiving?

Br
Casper

2

You may disable the ecs_compatibility in the receiving logstash, but other fields, like host and headers will be overwritten as explained in the documentation.

I don't think this can be disabled, at least there is nothing in the documentation about it.