search

logstash-plugins / logstash-codec-json

Apache License 2.0
23 stars 29 forks source link

fix: do not overwrite [event][original] decoded from payload #43

Closed yaauie closed 2 years ago

yaauie commented 2 years ago

In v3.1.0 of this plugin, we introduced ecs_compatibility support, so that when run in a pipeline for which ecs_compatibility was enabled (opt-in for Logstash 7.x, default in Logstash 8.x) this plugin would record the original bytes used to generated the bytes into the nested [event][original] field.

Unfortunately, this overwrites a value encoded at that address if the object represented by the JSON string we parsed included it.

Here we constrain the codec to only set the [event][original] when it is not present in the decoded payload.

Until this is merged and released, or for users who cannot upgrade their plugins, a work-around would be to instantiate the codec with ecs_compatibility explicitly disabled:

    codec => json { ecs_compatibility => disabled }