{"action":"opened","issue":{"url":"https://api.github.com/repos/saltstack/salt/issues/21075","labels_url":"https://api.github.com/repos/saltstack/salt/issues/21075/labels{/name}","comments_url":"https://api.github.com/repos/saltstack/salt/issues/21075/comments","events_url":"https://api.github.com/repos/saltstack/salt/issues/21075/events","html_url":"https://github.com/saltstack/salt/issues/21075","id":59096467,"number":21075,"title":"Specify format when logging to logstash","user":{"login":"andrejohansson","id":2828428,"avatar_url":"https://avatars.githubusercontent.com/u/2828428?v=3","gravatar_id":"","url":"https://api.github.com/users/andrejohansson","html_url":"https://github.com/andrejohansson","followers_url":"https://api.github.com/users/andrejohansson/followers","following_url":"https://api.github.com/users/andrejohansson/following{/other_user}","gists_url":"https://api.github.com/users/andrejohansson/gists{/gist_id}","starred_url":"https://api.github.com/users/andrejohansson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrejohansson/subscriptions","organizations_url":"https://api.github.com/users/andrejohansson/orgs","repos_url":"https://api.github.com/users/andrejohansson/repos","events_url":"https://api.github.com/users/andrejohansson/events{/privacy}","received_events_url":"https://api.github.com/users/andrejohansson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-26T16:20:25Z","updated_at":"2015-02-26T16:20:25Z","closed_at":null,"body":"I'm trying to use logstash for logging, and it works fine. But when I get log entries in elasticsearch, they look like below. But I want a slightly different format on the entry.\r\n\r\nHow can I...\r\n* ...add the minion id and the name of the command executed to the entry?\r\n* ...how can I remove fields that I dont want?\r\n\r\n**What I want**\r\n```\r\n {\r\n            \"_index\": \"logstash-2015.02.26\",\r\n            \"_type\": \"logstash\",\r\n            \"_id\": \"mPxo5wo2QOyjHBAp9pIEqg\",\r\n            \"_score\": 1,\r\n            \"_source\": {\r\n               \"tags\": [\r\n                  \"salt\"\r\n               ],\r\n               \"process\": 10008,\r\n               \"@timestamp\": \"2015-02-26T15:22:31.246+00:00\",\r\n               \"host\": \"somehost\",\r\n               \"message\": \"User sudo_saltop Executing command test.ping with jid 20150226152233737243\",\r\n               \"logger\": \"salt.minion\",\r\n               \"levelname\": \"INFO\",\r\n               \"command\": \"test.ping\",\r\n               \"minion\": \"robin\"\r\n            }\r\n         }\r\n```\r\n\r\n**What I get today**\r\n```\r\n {\r\n            \"_index\": \"logstash-2015.02.26\",\r\n            \"_type\": \"logstash\",\r\n            \"_id\": \"mPxo5wo2QOyjHBAp9pIEqg\",\r\n            \"_score\": 1,\r\n            \"_source\": {\r\n               \"tags\": [\r\n                  \"salt\"\r\n               ],\r\n               \"process\": 10008,\r\n               \"@timestamp\": \"2015-02-26T15:22:31.246+00:00\",\r\n               \"funcName\": \"info\",\r\n               \"host\": \"somehost\",\r\n               \"message\": \"User sudo_saltop Executing command test.ping with jid 20150226152233737243\",\r\n               \"type\": \"logstash\",\r\n               \"threadName\": \"MainThread\",\r\n               \"processName\": \"MainProcess\",\r\n               \"exc_info_on_loglevel\": null,\r\n               \"pathname\": \"logging/__init__.py\",\r\n               \"lineno\": 1149,\r\n               \"logger\": \"salt.minion\",\r\n               \"@version\": 1,\r\n               \"levelname\": \"INFO\"\r\n            }\r\n         }\r\n```\r\n\r\nI have the following settings:\r\n**logstash.conf**\r\n```\r\ninput {\r\n  stdin { }\r\n  udp {\r\n    port => 5601\r\n    codec => json\r\n  }\r\n}\r\noutput {\r\n  stdout { }\r\n  elasticsearch_http {\r\n    host => \"myhost\"\r\n    port => 8081\r\n    user => \"someuser\"\r\n    password => \"secret\"\r\n    index => \"logstash-%{+YYYY.MM.dd}\"\r\n  }\r\n}\r\n```\r\n\r\n**minion conf**\r\n```\r\nlogstash_udp_handler:\r\n  host: myhost\r\n  port: 5601\r\n  version: 1\r\n```"}}