Logstash data showing up as “message” field in elasticsearch

Question

I am trying to send some raw data to elasticsearch through logstash. I am trying to do this through the udp plugin but for now I dont think this is relevant.

Basically, I with to send key/value pairs, and I wish for this to show up as:

{
    "key_1": "value_1"
    ....
}

instead of:

{
    "message": "{\"key1\": \"value1\"}"
}

Is there any way for logstash to somehow "decode" the message as json and insert them as top level keys?

Thanks

Answer 1

I just needed to use a "json" codec on the input like so:

input {
    udp {
            port => 3425
            codec => "json"
    }
}

Thanks to Val for pointing this out