CODEWITHSUNDEEP
elasticsearchelastic-stackfluentd
Mickael Brangeon
Mickael Brangeon

Reputation: 79

fluentd and grok parser, add a key value

I use an input syslog and the parser with grok expressions in fluentd. It works well, but I would like to add a key in the fluentd parsed message. The key would be the whole message itself. example with raw key:

{
time: grokked time
host: grokked hostname
...
raw : the whole raw message,
}

how to do that ?

Upvotes: 0

Views: 434

Answers (2)

Mickael Brangeon
Mickael Brangeon

Reputation: 79

yep I got it working at the same time with

<filter syslog>
  @type record_transformer
  enable_ruby
  <record>
    raw ${record}
  </record>
</filter>

Upvotes: 0

Max Lobur
Max Lobur

Reputation: 6040

Add another filter:

 <filter **>
   @type record_transformer
   enable_ruby
   <record>
     raw ${record["message"]}
   </record>
 </filter>

Upvotes: 1

Related Questions