Skip to content

quotes in fields using LOGSTASH_FIELDS environment variable #58

@nniikkoollaaii

Description

@nniikkoollaaii

I wanted to add some custom fields to my logspout-generated events.

The Readme says:

You can also add arbitrary logstash fields to the event using the LOGSTASH_FIELDS container environment variable:

  # Add any number of arbitrary fields to your event
  -e LOGSTASH_FIELDS="myfield=something,anotherfield=something_else"

So my compose file:

...
logspout:
  environment:
    - ROUTE_URIS=logstash+tcp://logstash:5045
    - LOGSTASH_FIELDS="collector=logspout"
...

Problem is:
logspout-logstash doesn't remove the quotes for my field collector

Looking at the available fields for my index in elasticsearch:

[root@2c2dfff9f247 elasticsearch]# curl 'elasticsearch:9200/unbekannt-2018.01.31/_mapping/*?pretty'
{
  "unbekannt-2018.01.31" : {
    "mappings" : {
      "doc" : {
        "properties" : {
          "\"collector" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },
          "@timestamp" : {
            "type" : "date"
          },
...

As the result in my logstash.conf I can't use the field e.g.
if [\"collector] {} or
if ["collector] {} or
if [collector] {}

Solution for the problem
In the code of this adapter quotes aren't removed.
Using the following environment variable
- LOGSTASH_FIELDS=collector=logspout
solves the problem

Please change the Readme or fix this in the code

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions