title: Logstash exec input plugin - Remove command run from @message
body: <p>I'm using logstash 1.5.1 on a windows machine. I have to make a rest call, that delivers me JSON output.</p>
  
  <p>Therefore I'm using exec. The result is no json anymore :-(.</p>
  
  <blockquote>
    <p>The @message of this event will be the entire stdout of the command as
    one event.
    <a href="https://www.elastic.co/guide/en/logstash/current/plugins-inputs-exec.html" rel="nofollow">https://www.elastic.co/guide/en/logstash/current/plugins-inputs-exec.html</a></p>
  </blockquote>
  
  <p>My logstash configuration</p>
  
  <pre><code>input {
      exec {
          command =&gt; "C:\bin\curl\curl.exe http://localhost:8080/jolokia/read/metrics:name=trx.process.approved" 
          interval =&gt; 10
          codec =&gt; json { charset =&gt; "CP1252" }
      }
  }
  output {
    elasticsearch {
      node_name =&gt; test
      host =&gt; myhost  
    }
  }
  </code></pre>
  
  <p>The output under cmd</p>
  
  <pre><code>{"request":{"mbean":"metrics:name=trx.process.approved","type":"read"},"value":{"Count":14},"timestamp":1434643572,"status":200}
  </code></pre>
  
  <p>The unparseable output on elasticsearch (3 lines!)</p>
  
  <pre>
  
  C:\Daten\tools\logstash-1.5.1\bin>C:\bin\curl\curl.exe http://localhost:8080/jolokia/read/metrics:name=trx.process.approved
  {"request":"mbean":"metrics:name=trx.process.approved","type":"read"},"value":{"Count":14},"timestamp":1434641808,"status":200}
  </pre>
  
  <p>Usually I would try to cut only the JSON output, but somehow I'm limited on Windows regarding knowledge of that.</p>
  
  <p>I have tried the filter plugin split, to separate these three lines, but don't know how to drop line 1 and 2. </p>
  
  <pre><code>filter {
      split {     
      }
  }
  </code></pre>
  
  <p>Any pointers appreciated.</p>
  
  <p>In the end I only want to have this line to be send to elasticsearch:</p>
  
  <pre><code>{"request":{"mbean":"metrics:name=trx.process.approved","type":"read"},"value":{"Count":14},"timestamp":1434641808,"status":200}
  </code></pre>