logspout-logstash icon indicating copy to clipboard operation
logspout-logstash copied to clipboard

quotes in fields using LOGSTASH_FIELDS environment variable

Open nniikkoollaaii opened this issue 6 years ago • 0 comments

I wanted to add some custom fields to my logspout-generated events.

The Readme says:

You can also add arbitrary logstash fields to the event using the LOGSTASH_FIELDS container environment variable:

  # Add any number of arbitrary fields to your event
  -e LOGSTASH_FIELDS="myfield=something,anotherfield=something_else"

So my compose file:

...
logspout:
  environment:
    - ROUTE_URIS=logstash+tcp://logstash:5045
    - LOGSTASH_FIELDS="collector=logspout"
...

Problem is: logspout-logstash doesn't remove the quotes for my field collector

Looking at the available fields for my index in elasticsearch:

[root@2c2dfff9f247 elasticsearch]# curl 'elasticsearch:9200/unbekannt-2018.01.31/_mapping/*?pretty'
{
  "unbekannt-2018.01.31" : {
    "mappings" : {
      "doc" : {
        "properties" : {
          "\"collector" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "@timestamp" : {
            "type" : "date"
          },
...

As the result in my logstash.conf I can't use the field e.g. if [\"collector] {} or if ["collector] {} or if [collector] {}

Solution for the problem In the code of this adapter quotes aren't removed. Using the following environment variable - LOGSTASH_FIELDS=collector=logspout solves the problem

Please change the Readme or fix this in the code

nniikkoollaaii avatar Jan 31 '18 08:01 nniikkoollaaii