foo.md

logstash json format

{
  "message"    => "hello world",
  "@version"   => "1",
  "@timestamp" => "2014-04-22T23:03:14.111Z",
  "type"       => "stdin",
  "host"       => "hello.local"
}

• @timestamp is the ISO8601 high-precision timestamp for the event.
• @version is the version number of this json schema
• Every other field is valid and fine.

Observe it in real life

You can observe the message structure by doing output { stdout { codec => rubydebug } }

% bin/logstash  -e 'output { stdout { codec => rubydebug } }'
hello world

{
  "message"    => "hello world",
  "@version"   => "1",
  "@timestamp" => "2014-04-22T23:03:14.111Z",
  "type"       => "stdin",
  "host"       => "Macintosh.local"
}