Sending elasticsearch5.1.1 slowlog to logstash 5.1.1 as an input

Question

This is the logstash5.1.1 config file content which is used to match the slowlog of elasticsearch5.1.1.

    input {
  file {
    path => "C:\Users\571952\Downloads\elasticsearch-5.1.1\elasticsearch-5.1.1\logs\elasticsearch_index_search_slowlog"
    start_position => "beginning"
  }
}

filter {
  grok {  # parses the common bits
    match => [ "message", "[%{TIMESTAMP_ISO8601:logtime}][%{LOGLEVEL:log_level}]
[%{DATA:es_slowquery_type}]\s*[%{DATA:es_host}]\s*[%{DATA:es_index}]\s*[%{DATA:es_shard}]\s*took[%{DATA:es_duration}],\s*took_millis[%{DATA:es_duration_ms:float}],\s*types[%{DATA:es_types}],\s*stats[%{DATA:es_stats}],\s*search_type[%{DATA:es_search_type}],\s*total_shards[%{DATA:es_total_shards:float}],\s*source[%{GREEDYDATA:es_source}],\s*extra_source[%{GREEDYDATA:es_extra_source}],"]
     }

  mutate {
    gsub => [
      "source_body", "], extra_source[$", ""
    ]
  }
}

output {
  file {
    path => "C:\Users\571952\Desktop\logstash-5.1.1\just_queries"
    codec => "json_lines"
    message_format => "%{source_body}"
  }
}

When i executed this in logstash 5.1.1 i got error like this

   [2017-01-03T11:45:20,419][FATAL][logstash.runner          ] The given configuration is in
valid. Reason: The setting `message_format` in plugin `file` is obsolete and is no longer
 available. You can achieve the same behavior with the 'line' codec If you have any quest
ions about this, you are invited to visit https://discuss.elastic.co/c/logstash and ask.

Can anyone help me in solving this error?

Answer 1

message_format is deprecated since logstash 2.2 version and removed from logstash 5.1 version.

Remove that line.