logstash mix json and plain content

Question

I use logstash as a syslog relay, it forwards the data to a graylog and writes data to a file.

I use the dns filter module to replace the IP with the FQDN and after this I can't write raw content to file, the IP is "json-ed".

What I get :

2022-05-17T15:17:01.580175Z {ip=vm2345.lab.com} <86>1 2022-05-17T17:17:01.579496+02:00 vm2345 CRON 2057538 - -  pam_unix(cron:session): session closed for user root

What I want to get :

2022-05-17T15:17:01.580175Z vm2345.lab.com <86>1 2022-05-17T17:17:01.579496+02:00 vm2345 CRON 2057538 - -  pam_unix(cron:session): session closed for user root

My config :

input {
  syslog {
    port => 514
    type => "rsyslog"
  }
}

filter {
    if [type] == "rsyslog" {
        dns {
            reverse => [ "[host][ip]" ]
            action => "replace"
        }
    }
}

output {
  if [type] == "rsyslog" {
    gelf {
      host => "graylog.lab.com"
      port => 5516
    }
    file {
      path => "/data/%{+YYYY}/%{+MM}/%{+dd}/%{[host][ip]}/%{[host][ip]}_%{{yyyy_MM_dd}}.log"
      codec => "line"
    }
    stdout { }
  }
}

What's the best way to handle this ?

Answer 1

When you use codec => line, there is no default setting for the @format option, so the codec calls, .to_s on the event. The toString method for an event concatenates the @timestamp, the [host] field, and [message] field. You want the [host][ip] field, not the [host] field (which is an object) so tell the codec that

codec => line { format => "%{@timestamp} %{[host][ip]} %{message}" }