input {
gelf {
port => 12201
type => "gelf"
}
}
output {
stdout { codec => rubydebug }
}
{
"version": "1.1",
"host": "example.org",
"short_message": "",
"timestamp": 1385053862.3072,
"level": 1,
"_user_id": 9001,
"_some_info": "foo",
"_some_env_var": "bar"
}
When receiving a GELF event with an empty
short_messageand nofull_messagethen it does not get remapped as expected. This is a consequence of PR #18 by @ggtools.Removing the
&& !event.get("short_message").empty?-part would fix it.Feed sample data to Logstash and observe that the output contains
short_messageinstead ofmessage.