{"action":"opened","issue":{"url":"https://api.github.com/repos/IBM-ITOAdev/Using-Rsyslog-and-Syslog-NG-with-Logstash-and-SCALA/issues/1","labels_url":"https://api.github.com/repos/IBM-ITOAdev/Using-Rsyslog-and-Syslog-NG-with-Logstash-and-SCALA/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/IBM-ITOAdev/Using-Rsyslog-and-Syslog-NG-with-Logstash-and-SCALA/issues/1/comments","events_url":"https://api.github.com/repos/IBM-ITOAdev/Using-Rsyslog-and-Syslog-NG-with-Logstash-and-SCALA/issues/1/events","html_url":"https://github.com/IBM-ITOAdev/Using-Rsyslog-and-Syslog-NG-with-Logstash-and-SCALA/issues/1","id":70159717,"number":1,"title":"Fix duplicate message fields in logstash event","user":{"login":"dougmcclure","id":3448963,"avatar_url":"https://avatars.githubusercontent.com/u/3448963?v=3","gravatar_id":"","url":"https://api.github.com/users/dougmcclure","html_url":"https://github.com/dougmcclure","followers_url":"https://api.github.com/users/dougmcclure/followers","following_url":"https://api.github.com/users/dougmcclure/following{/other_user}","gists_url":"https://api.github.com/users/dougmcclure/gists{/gist_id}","starred_url":"https://api.github.com/users/dougmcclure/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dougmcclure/subscriptions","organizations_url":"https://api.github.com/users/dougmcclure/orgs","repos_url":"https://api.github.com/users/dougmcclure/repos","events_url":"https://api.github.com/users/dougmcclure/events{/privacy}","received_events_url":"https://api.github.com/users/dougmcclure/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-22T15:27:29Z","updated_at":"2015-04-22T15:27:29Z","closed_at":null,"body":"In the grok pattern, I am naming the original message 'message' which conflicts with the default logstash message field.  The entire message is then sent towards LA.  \r\n\r\nUpdate the grok pattern to name the original message 'origMessage'.\r\nAdd a \\s+ to the pattern to account for the space which is in front of that field.\r\nUpdate the output fields list with the new 'origMessage' field name."}}