Merge pull request #173 from cloud-gov/RDSmessage

RdS message is now on a used field

jobs/ingestor_cloudwatch/templates/config/input_and_output.conf.erb

@@ -18,19 +18,19 @@ filter
 {
     mutate {
         rename => {"[cloudwatch_logs][tags][environment]"=>"environment"}
-        
+
         rename => {"[cloudwatch_logs][tags][OrganizationGUID]"=>"[@cf][org_id]"}
         rename => {"[cloudwatch_logs][tags][Organization GUID]"=>"[@cf][org_id]"}
-        
+
         rename => {"[cloudwatch_logs][tags][SpaceGUID]"=>"[@cf][space_id]"}
         rename => {"[cloudwatch_logs][tags][Space GUID]"=>"[@cf][space_id]"}
-        
+
         rename => {"[cloudwatch_logs][tags][Spacename]"=>"[@cf][space]"}
         rename => {"[cloudwatch_logs][tags][Space name]"=>"[@cf][space]"}
-        
+
         rename => {"[cloudwatch_logs][tags][Organizationname]"=>"[@cf][org]"}
         rename => {"[cloudwatch_logs][tags][Organization name]"=>"[@cf][org]"}
-        
+
         rename => {"[cloudwatch_logs][tags][InstanceGUID]"=>"[@cf][service_instance_id]"}
         rename => {"[cloudwatch_logs][tags][Instance GUID]"=>"[@cf][service_instance_id]"}
 
@@ -53,9 +53,11 @@ filter
         remove_field => ["[cloudwatch_logs][tags][Plan GUID]"]
         remove_field => ["[cloudwatch_logs][tags][ServiceGUID]"]
         remove_field => ["[cloudwatch_logs][tags][Service GUID]"]
+
+        rename => [ "message" => "@message" ]
     }
     truncate {
-      fields => ["message"]
+      fields => ["@message"]
       add_tag => [ "_logtrimmed" ]
       length_bytes => 32765
     }