Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.Sign up
Wrong semantics in omelasticsearch createMsgFromRequest() #3573
As createMsgFromRequest() comment said in plugins/omelasticsearch.c :
An expected behavior is rsyslog can get rawmsg as data part.
Only message format that contains "message" filed can be extracted from request, but not for custom message format.
Steps to reproduce the behavior
The latest code shows that this problem still exists.
the request have two part separated by "\n"
The original message is the data part, we needed:
But only data part contains "message" field can be extracted, or omelasticsearch will keep the whole request in rawmsg.
The problem is here:
If the original request has a field
@snaix is asking that instead, the rawmsg should be only the data part, not the metadata, so something like this: