logspout-logstash
logspout-logstash copied to clipboard
quotes in fields using LOGSTASH_FIELDS environment variable
I wanted to add some custom fields to my logspout-generated events.
The Readme says:
You can also add arbitrary logstash fields to the event using the LOGSTASH_FIELDS container environment variable:
# Add any number of arbitrary fields to your event -e LOGSTASH_FIELDS="myfield=something,anotherfield=something_else"
So my compose file:
...
logspout:
environment:
- ROUTE_URIS=logstash+tcp://logstash:5045
- LOGSTASH_FIELDS="collector=logspout"
...
Problem is: logspout-logstash doesn't remove the quotes for my field collector
Looking at the available fields for my index in elasticsearch:
[root@2c2dfff9f247 elasticsearch]# curl 'elasticsearch:9200/unbekannt-2018.01.31/_mapping/*?pretty'
{
"unbekannt-2018.01.31" : {
"mappings" : {
"doc" : {
"properties" : {
"\"collector" : {
"type" : "text",
"fields" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
},
"@timestamp" : {
"type" : "date"
},
...
As the result in my logstash.conf I can't use the field e.g. if [\"collector] {} or if ["collector] {} or if [collector] {}
Solution for the problem
In the code of this adapter quotes aren't removed.
Using the following environment variable
- LOGSTASH_FIELDS=collector=logspout
solves the problem
Please change the Readme or fix this in the code