Add field from ECS field (winlogbeats)

Elastic Stack Logstash
1

I am trying to add some fields to the logs coming from wingbeat 7.9 to Logstash.

I need to extract the value from either user.name or related.user and add a new 'username' field.

I was doing something like this but this just adds the text '%related.user' to the logs. Is this possible at all?

      if [type] == "winlogbeat" and [user][name]  {
          mutate {
                    add_field  => [ "username", "%[user][name]" ]
                 }
       }

Thanks,
Camilo

2

A sprintf reference should look like

"%{[user][name]}"
3

Thanks @Badger. Dunno how I missed that :slight_smile:

Working as expected now.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.