Open jazzzz opened 8 years ago
I concur. Especially when the incoming message contains a field such as _type
, overwriting type
plays merry hell with Logstash.
@jbladen I could not find a reference to a reserved field called type
in Logstash, do you have a link?
looks like it's best to remove leading underscore from _type
, as elasticsearch uses this field internally, and it does not seem to confuse logstash in the least. i'll update the PR
Currently, if a GELF message contains
level
and_level
fields, the value of_level
overwriteslevel
. The leading underscore should be kept when an additional field has the same name as a GELF field (version
,host
,short_message
,full_message
,timestamp
,level
,facility
,line
andfile
).