How to override facility

[n3xus]

How to override facility?

I've tried custom_fields, add_field in filter. But no success. It's always defaulting to gelf-rb

[Slapper]

I also have the same issue here. I am try to sent gelf udp messages from logstash to graylog2 and i am always getting facility gelf-rb. Anyone find a solution here ?

[n3xus]

@Slapper One ugly way is to change source code. A downside is you have to do it everytime you upgrade the plugin. Just find "gelf-rb" text in a source code and change it.

A better way is to ignore "facility" field and start using a different field for all of your applications.

[Slapper]

Thanks for the prompt response @n3xus ! I agree change source code it's an ugly thing. I probably have to go with the other option and use different fields for my apps.

Thanks again!

[Slapper]

For anyone want to disable default facility to the source code, comment the following line in :
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/gelf-3.0.0/lib/gelf/notifier.rb

#self.default_options['facility'] ||= 'gelf-rb'