Why is id field dropped from message?

[sapajune]

I have message with id field and that was not being transmitted. Looking at code it indeed is deleted from message with comment that it is not possible to send id. Seemed kind of arbitrary restriction so I checked the GELF spec and it has no special meaning to field named id.

Tested modifying code to not drop the id and it worked perfectly so is there any real reason to drop the id field?

I'm using TCP output to send messages to Graylog 2.

[kkamkou]

Your right. * in first versions of graylog-server it was not possible to send the id field.

[sapajune]

Could this limitation be now removed or made an option then? I have use case where id field is necessary and I'd like to avoid doing extra mapping in both sender and Graylog.

[kkamkou]

Are u sure that the id of a message is your custom one and not generated via UUID? (post a permalink url, please)

[sapajune]

In the message I send id field contains UUID. In Graylog this shows up in id field and Graylog generated message id is unaffected. Seems to me it is working properly.

Cannot send permalink unfortunately. Here's screenshot.

Edit: To clarify, this is message that was sent with id allowed to pass through. Other messages don't have the id field at all.

[kkamkou]

The "_id" is used as document ID to address the document in Elasticsearch.. Could you try to send two messages with the same id?
ref: https://github.com/Graylog2/graylog2-server/blob/35e06e2573ee08a72f391f68d6959bdfd285018d/graylog2-server/src/main/java/org/graylog2/plugin/Message.java#L75

[sapajune]

As a workaround I resorted to send id field as messageId and copying it to id in Graylog end using extractor so this is not a show stopper for me anymore.

As I see it (on Graylog 2 and later at least) _id is separate from id field. I haven't explicitly checked but I'm quite sure also that it is possible to have multiple messages with same id field value (but not _id) since the use case actually does this - it reports several events related to one id.