Logstash split by newline madness

README.md

Debugging

https://github.com/alexgerv/logstash-config-tester

config.conf

input {
    stdin {  }
}

filter {
	json {
    	source =>  "message" 
	}

	mutate {
          copy => { "message" => "message_head" }
        }

	mutate { split => ["message_head", "
"] }

        mutate {
          # save the first element of the array as the event_name.
          add_field => ["event_name", "%{[message_head][0]}" ]

          # Remove message_head field
          remove_field => ["message_head"]
        }
}

output {
    stdout { codec => rubydebug }
}