Key value converter - replace message content


(Rui) #1

Hi all,
I have an input receiving messages following the pattern presented bellow:

hostname=myHost service=myServiceName time="2017-04-26T10:22:42+01:00" level=info message="Here goes the log message"

I’d like to create an extractor “Copy Input” type, and apply the key value converter.
-> What’s the correct value to “store as field”?
-> Message field does not override the original message. I think it would be nice to replace the original message with the field “message=” content. Is that possible without adding additional converters and complexities?

Thanks.


(Jan Doberstein) #2

your questions are answered in the documentation.


(Rui) #3

You’re right, the first question answered on the docs. I guess the answer to the second question is that it’s not possible to override the original message with the content of message field, without additional processing. Right?

Thanks.


(Jan Doberstein) #4

yes @ralberto

you catch the fish