Thanks. But before that, is there any related patch which I can refer to? I've googled for a long time and found nothing useful. 

2014-11-19 14:34 GMT+08:00 Hari Shreedharan <>:
Flume 1.5.2 was a targeted release for specific security fixes, and did not pull in other patches. Please wait for 1.6 release which should be happening in a few weeks, I guess.


On Mon, Nov 17, 2014 at 1:48 AM, shadyxu <> wrote:

Hi everyone,

I am now using Flume to collect log into ElasticSearch. And the logs are in json format. However, when I check them in ES, it seems that Flume has put the entire json log in the @message attribute. Is there any config to do or need I do some coding to separate them into different columns as ES always does?

BTW, I found that ttl seems not working in ElasticSearch. I'm using Flume

Any clue shall be appreciated.