type not set when using json_event type

[turtlebender]

I noticed that if you use the shipper and configure the logstash instance to receive a json_event format, the type of the event is not set, which means that filters won't run against the event. I figure one approach would be to set the type from the shipper. another would be to have logstash set the type if the deserialized json_event doesn't have one. I'm happy to patch either of these approaches or, if there is another one, use that

[lusis]

We could set the type from the shipper side but remember that all inputs in logstash require type anyway. Logstash SHOULD set that on input. If it's not, we've got a logstash bug.

It probably wouldn't hurt to provide an optional argument that takes a dict to merge into the JSON.

[turtlebender]

I'd say there is a logstash bug. If you look in lib/logstash/inputs/base.rb, at the beginning, a new event is created and the type is set. Under the when "json_event" that event is replaced with the deserialization of the json and the type is not set.

I'm happy to patch this if you'd like.

-Tom

On Fri, Mar 23, 2012 at 7:59 AM, John E. Vincent [email protected] wrote:

We could set the type from the shipper side but remember that all inputs in logstash require type anyway. Logstash SHOULD set that on input. If it's not, we've got a logstash bug.

It probably wouldn't hurt to provide an optional argument that takes a dict to merge into the JSON.

---

Reply to this email directly or view it on GitHub: https://github.com/lusis/logstash-shipper/issues/2#issuecomment-4658489

Tom Howe Senior Software Engineer Distributed Systems Lab University of Chicago/Argonne National Laboratory