search

logstash-plugins / logstash-output-gelf

Apache License 2.0
15 stars 18 forks source link

Clarify docs regarding dynamic fields #11

Open runningman84 opened 8 years ago

runningman84 commented 8 years ago 
  # The GELF full message. Dynamic values like `%{foo}` are permitted here.
  config :full_message, :validate => :string, :default => "%{message}"

  # The GELF short message field name. If the field does not exist or is empty,
  # the event message is taken instead.
  config :short_message, :validate => :string, :default => "short_message"

What is the difference between "%{message}" and "message"? Why do you use "%{message}" and "short_message"?

What is the best practice here?

jordansissel commented 8 years ago

It's confusing, so I'll try to clarify. It's likely we can improve the configuration of this plugin to make it more consistent.

The full_message setting supports formatted/sprintf values so you could do: full_message => "Hello, %{user}! Your message is %{message}." -- and the field values for 'user' and 'message' fields will be injected in place of things like %{user} etc.

The short_message setting takes a field name, not a formatted value. In this case, we are instructing Logstash to populate the GELF short_message field with the event field named short_message.

The differences between these two settings are confusing (one supports formatting, the other just wants a field name).

Does this clarify the current behavior?

I am open to making short_message support formatting. Thoughts?

runningman84 commented 8 years ago

Yes that helps, I would recommend to give short_message also formatting support.