Add_field getting wrong value

Elastic Stack Logstash
1

I am using jdbc to connect to database
getting different field trying to make new field but it give me something weired output. what am I doing wrong?

filter {
mutate {
add_field => { "did" => "%{serial}%{sid}%{uid}" }
}
}

output {
elasticsearch {
hosts => ["localhost:9200"]
index => test
document_id => "%{did}"
}
}

I get did= 2598510117815, 2598510117815 (where is this coming from)_
serial=25985
sid=10117
uid=815

Why it is coming with , and double time?

2

You would get an array with two copies of the field in it if your configuration contained

    mutate { add_field => { "did" => "%{serial}%{sid}%{uid}" } }
    mutate { add_field => { "did" => "%{serial}%{sid}%{uid}" } }

Do you have a backup copy of the configuration in another file? If you point -f to a directory logstash will concatenate all of the files in it to create a configuration. Probably getting duplicate entries in elasticsearch too.

3

Badger,
how do I get only one value. I don't want array of that duplicate thing.

4

If you do not want an array then do not call add_field twice for the same field name. You may not think you are doing so, but I am pretty certain that you are.

5

that make sense.
I have this field did inside many config file. and all of them getting some weired number letter.

if logstash is reading all the files and doing this then not a good design but your point make sense.

OK
I test it. Change all variable name to something different in all config file and I am getting what I desire. Thank you very much.

This is stupid but has not mention anywhere. I was fighting with this from many days.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.