Confused around @variables, builtins
Description
discovered while testing
Gliffy Diagrams
Activity
Philippe Weber May 16, 2014 at 10:32 AM
This PR exists for syslog-pri https://github.com/logstash/cookbook/pull/86
I suppose that central-syslog needs a complete review, registered this issue in the cookbook
https://github.com/logstash/cookbook/issues/93
Paul Morahan November 12, 2013 at 1:28 AM
Thanks for the clarification, Jordan. I was coming into logstash from a syslog centralisation viewpoint, and the cookbook for both standalone and central syslogs use both 'message' and '@message' fields. The '@' prefix looked like it was a system variable (re:timestamp and version), but it didn't seem to flow that way with '@message' in those examples.
I found it puzzling watching the debug console (or kibana), because every log line seemed to be recorded twice, once each in message and @message.
Perhaps put the syslog cookbook entries on the documentation cleanup radar? There's one or two other @-prefixed variables that aren't timestamp/version in there as well.
http://cookbook.logstash.net/recipes/central-syslog/
http://cookbook.logstash.net/recipes/syslog-pri/
Jordan Sissel November 11, 2013 at 7:27 PMEdited
In logstash 1.2 there are only two fields guaranteed to be present in every event, @timestamp and @version. @timestamp contains the time the event occurred at. @version is just a version for the schema that represents this event, it is currently "1" and I don't expect it to change any time soon.
The '@' prefixing is to avoid conflicting with any fields you might have in your own events. This choice of using "@" was because I've never seen anyone use this as a prefix yet, so it seemed a good choice.
In terms of "What is the difference" - functionally speaking, a field is a field. The name of that field doesn't matter.
Does this help explain things?
Jordan Sissel November 11, 2013 at 7:25 PM
@message isn't a thing anymore.
Philipp H November 11, 2013 at 5:38 PM
I have the same problem. What is the difference between message and @message?
Logstash newbie here. Short form of the problem is that I can't find any documentation describing what variables beginning with '@' mean - whether they're inbuilts, limited in some way, or whatever.
I think I've got the system working properly now, though it's probably not ideal. This was just a confusing part/lack in the documentation - I'm still not sure what the actual story is, but I seem to have a working system now.
Edit: removed superfluous confusing waffle, written while deleriously ill