Logstash pipeline adding extra timestamp%{host} in beginning of rsyslog message-CodePudding

I am using logstash pipeline to ingest data into rsyslog server .

But the pipeline is adding extra date stamp and %{host} at the beginning

example:

**Sep 22 04:47:20 %{host}  2022-09-22T04:47:20.876Z %{host}** 22-09-2022 05:47:20.875 a7bd0ebd9101-SLOT0   `TEST-AWS-ACTIVITY`#011970507     P        201059147698 `[FCH-TEST] [35.49.122.49] [TEST-251047********-******] [c713fcf9-6e73-4627-ace9-170e6c72fac5] OUT;P;201059147698;;;;/bcl/test/survey/checkSurveyEligibility.json;ErrorMsg=none;;{"body":{"eligible":false,"surveys":[]},"header":null}`**

Can anyone tell from where this extra part is coming and how to suppress this .

The data is coming from AWS cloudwatch installed on ECS containers.

The pipeline is configured as :

input  { pipeline { address => test_syslog } }

filter {

if [owner] == "1638134254521"  { 
   mutate { add_field  =>  { "[ec_part]" => "AWS_TEST"} }
  
  } 
}

output {
#TEST ACTIVITY Logs being sent via TCP to Logreceiver
  if [ec_part] == "AWS_TEST" {
  syslog {
    appname => ""
    host => "10.119.140.206"
    port => "10514"
    protocol => "ssl-tcp"
    ssl_cacert => "/etc/logstash/ca.crt"
    ssl_cert => "/etc/logstash/server.crt"
    ssl_key => "/etc/logstash/server.key"
    priority => "info"
    rfc => "rfc5424"
  }
  }
}

CodePudding user response：

The default codec for an output is plain, and the if the format option is not specified then that will call the .to_s method on the event. The .to_s method adds the timestamp and %{host}. You can prevent this by adding

codec => plain { format => "%{message}" }

to your syslog output.