2.3.4 - Adding Nested Fields to Events

Elastic Stack Logstash
#1

Hi,
I'm trying to add a k/v pair of type:

type.field.size

to events using the ruby filter and it is failing. My latest attempt looks like this:

ruby {
  code => "
    event.append({'document' =>{'message' => {'size' => event['message'].bytesize}}})
  "
}

Can someone clarify for me how I should be doing this?

Regards,
David

#2

Not sure why you're using append. I'd expect

event['document'] = {'message' => {'size' => event['message'].bytesize}}

to work (in Logstash 2.4 and earlier at least).

#3

It doesn't appear to be working although it's not logging errors either:

ruby {
code => "
event['document'] = {'message' => {'size' => event['message'].bytesize}}
event['message'] = event['message'][0..1000]
event['document'] = {'message' => {'action' => 'truncated'}}
"
}

"document.message.action" is working but "document.message.size" is not with no errors reported by logstash or on the es master node. Am I referencing the size of the message field properly?

#4

I figured it out. Need to add size and action as part of the same update...

#5