Default codec is plain, not json

[ppf2]

• Version: 2.3 https://www.elastic.co/guide/en/logstash/master/plugins-outputs-kafka.html#plugins-outputs-kafka

The default codec is json, so events will be persisted on the broker in json format. If you select a codec of plain, Logstash will encode your messages with not only the message but also with a timestamp and hostname.

Doc paragraph above says that the default codec is json, but it is actually plain.

[ppf2]

Also, will be nice to clarify that when using plain codec (or the default), it writes the event to Kafka as a single plain string, which means that:

output received {:event=>{"message"=>"Hello world!", "@version"=>"1", "@timestamp"=>"2016-05-03T07:26:54.695Z", "host"=>"Iceman", "sequence"=>499}, :level=>:debug, :file=>"(eval)", :line=>"22", :method=>"output_func"}

Will end up being written to Kafka as

2016-05-03T07:26:54.695Z Iceman Hello world!

i.e. with the timestamp and host information appended to the beginning of the message (i.e. the end user will have to grok this back from the indexer pipeline).

[talevy]

thanks @ppf2, I agree. We do not document codec-plain enough

[sshantveer]

If I want to get the entire message to be written to the Kafka, what should be the codec configuration ? codec => json ?