Add_field not performing variable substitution

Elastic Stack Logstash
1

Hi all,

Newbie to logstash here but I'm sure this should work. I am creating a metric and need to be able to split by http result code. The result code is stored in %{rcode}. In the below the variable is being substituted in the metric name correctly but not in the add_field method.

Any ideas?
Thanks
Jeff

filter {
if [type] == "heeaccesslogs" {
metrics {
meter => "heeevents_rcode_%{rcode}"
add_tag => "metric"
add_field => { "rcode" => "%{rcode}" }
add_field => { "type" => "heemetric" }
}
}
}

2

Show us an example of the kind of event you want to process (preferably using a stdout { codec => rubydebug } output).

add_field => { "rcode" => "%{rcode}" }

This doesn't make sense. You're trying to assign a field to its current value.