Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not strip leading underscore from fields conflicting with GELF fields #25

Open
jazzzz opened this issue Nov 18, 2015 · 3 comments · May be fixed by #47 or #72
Open

Do not strip leading underscore from fields conflicting with GELF fields #25

jazzzz opened this issue Nov 18, 2015 · 3 comments · May be fixed by #47 or #72

Comments

@jazzzz
Copy link

jazzzz commented Nov 18, 2015

Currently, if a GELF message contains level and _level fields, the value of _level overwrites level. The leading underscore should be kept when an additional field has the same name as a GELF field (version, host, short_message, full_message, timestamp, level, facility, line and file).
@jbladen
Copy link

jbladen commented Feb 2, 2016

I concur. Especially when the incoming message contains a field such as _type, overwriting type plays merry hell with Logstash.

@jazzzz
Copy link
Author

jazzzz commented Sep 14, 2016

@jbladen I could not find a reference to a reserved field called type in Logstash, do you have a link?

Cactusbone added a commit to F4-Group/logstash-input-gelf that referenced this issue Sep 14, 2016
@Cactusbone
avoid fields with underscore from overriding GELF field fixes logstas…
0f0e71c 
…h-plugins#25
@Cactusbone Cactusbone linked a pull request Sep 14, 2016 that will close this issue
Open
@Cactusbone
Copy link

looks like it's best to remove leading underscore from _type, as elasticsearch uses this field internally, and it does not seem to confuse logstash in the least. i'll update the PR

Cactusbone added a commit to F4-Group/logstash-input-gelf that referenced this issue Mar 7, 2023
@Cactusbone
test: add test with leading underscore from field conflicting with GE…
1aa45a4 
…LF fields

See logstash-plugins#25
Cactusbone added a commit to F4-Group/logstash-input-gelf that referenced this issue Mar 7, 2023
@Cactusbone
fix: do not overwrite GELF internal fields
dc900ed 
Fixes logstash-plugins#25
@Cactusbone Cactusbone linked a pull request Mar 7, 2023 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
3 participants
@jazzzz @Cactusbone @jbladen