I'm new to Logstash, and I'm trying to understand how inputs, filters and outputs work together. I get that there's a variety of inputs, filters and outputs, but what I don't get is how Logstash works with messages internally.
Say I configure a syslog input, and I'd like syslog events to be shipped to log index as GELF. There's a syslog input I can use, and there's a GELF output I can use. However, is it my responsibility (using filters) to populate the correct GELF field based on values from the syslog event?
Should I look at events (from input filters) as an entity with named fields (sort of a key:value array), and then use filters to make sure that outputs can get hold of the right data?