How do I add a custom field to logstash/kibana?
<p>I am using <a href="https://github.com/vklochan/python-logstash" rel="nofollow">python-logstash</a> in order to write to logstash. It offers the option to add extra fields  but problem is that all fields are under the <code>message</code> field. What I want to accomplish is adding a new field at the higher level. </p>

<p>I found the option to do that from the <code>logstash.config</code> (using <code>ruby</code>/<code>grok</code>/<code>mutate</code> plugins) but this solution is not a scalable one (Would have to configure for every machine instance)</p>

<p>Something like:</p>

<pre><code>logger.info('my message')
</code></pre>

<p>And in Kibana I will see:  </p>

<pre><code>{
'@timestamp': ...
...
...
'message': 'my message'
'new_field' : 'new_field_value'
}
</code></pre>

<p>How do I do that?</p>

<p>Thanks.</p>

<p>From reading the python-logstash documentation, they refer to "extra" fields and say they "add extra fields to logstash message", which seems like exactly what you want!</p>

<pre><code># add extra field to logstash message 
extra = {
    'test_string': 'python version: ' + repr(sys.version_info),
    'test_boolean': True,
    'test_dict': {'a': 1, 'b': 'c'},
    'test_float': 1.23,
    'test_integer': 123,
    'test_list': [1, 2, '3'], 
}
test_logger.info('python-logstash: test extra fields', extra=extra)
</code></pre>

<p>And then ensure that you have the "json" codec in the logstash input block like this:</p>

<pre><code>input {
  udp {
    port =&gt; 5959
    codec =&gt; json
  }
}
</code></pre>

<p><strong>EDIT</strong>: 
I tested this with the sample script and get the following Logstash output:</p>

<pre><code>{
            "host" =&gt; "xxx",
            "path" =&gt; "pylog.py",
      "test_float" =&gt; 1.23,
            "type" =&gt; "logstash",
            "tags" =&gt; [],
       "test_list" =&gt; [
        [0] 1,
        [1] 2,
        [2] "3"
    ],
    "test_boolean" =&gt; true,
           "level" =&gt; "INFO",
      "stack_info" =&gt; nil,
         "message" =&gt; "python-logstash: test extra fields",
      "@timestamp" =&gt; "2016-09-25T15:23:58.259Z",
       "test_dict" =&gt; {
        "a" =&gt; 1,
        "b" =&gt; "c"
    },
     "test_string" =&gt; "python version: sys.version_info(major=3, minor=5, micro=1, releaselevel='final', serial=0)",
        "@version" =&gt; "1",
    "test_integer" =&gt; 123,
     "logger_name" =&gt; "python-logstash-logger"
}
</code></pre>

<p>All of the extra fields added show at the same level as the message field. They are not added to the 'message' inner-object.</p>

python logstash