Logstash grok match filter what is the message key?

Question

For almost every grok filter when using "match" the value is another hash whose key is "message". What is the significance of the key "message"?

It seems like the value portion of the hash is where all the parsing happens. Is this key just always message? Does the key have any affect on the outputted values?

filter {
  grok {
    match => { "message" => "%{SYSLOGBASE} %{DATA:data}" }
  }
}

Answer 1

In this case, message is a property of the event class. An event comes from the input, ie for a STDOUT input (or any syslog file for example) each line will be a new event where message will be the actual text in that line.

What the grok filter will do with the sample code you've given is essentially something along the lines of:

(pseudocode)

 match(event, field, pattern)
   value = event.get(field) #field = 'message'; value = the actual text
   pattern.match(value)

If the match is successful it will then change the value of event.message because you do %{DATA:message} .

If you're interested the relevant source code is here , particularly match() and handle().