search

logstash-plugins / logstash-input-gelf

Apache License 2.0
20 stars 39 forks source link

Do not strip leading underscore from fields conflicting with GELF fields #25

Open jazzzz opened 8 years ago

jazzzz commented 8 years ago

Currently, if a GELF message contains level and _level fields, the value of _level overwrites level. The leading underscore should be kept when an additional field has the same name as a GELF field (version, host, short_message, full_message, timestamp, level, facility, line and file).

jbladen commented 8 years ago

I concur. Especially when the incoming message contains a field such as _type, overwriting type plays merry hell with Logstash.

jazzzz commented 7 years ago

@jbladen I could not find a reference to a reserved field called type in Logstash, do you have a link?

Cactusbone commented 7 years ago

looks like it's best to remove leading underscore from _type, as elasticsearch uses this field internally, and it does not seem to confuse logstash in the least. i'll update the PR