1

Is there any way to read logstash raw input data that is forwarded via certain port?

input settings are as below

input {
    tcp {
          port => 1234
          type => "test"
   }
}

and from output config...

output {
  stdout { codec => rubydebug }
}

we can only see the logstash output but not the original input data..

any idea how can i read the input log?

1 Answers1

1

You can copy things in a filter block:

filter {
  mutate {
    add_field => { "raw_input": "%{message}" }
  }
}

Which will give you the raw input in a raw_input field.

sysadmin1138
  • 133,124
  • 18
  • 176
  • 300