Add_field with a name generated from message data

[jrihds]

Hello,

Is it possible to add a new field whose name is based on data from the message? e.g.

add_field => {
"%{[parsed-json][0][key]}" => "%{[parsed-json][0][value]}"
}

I am currently getting an 'Invalid FieldReference' error.

For completeness, the following config works successfully but doesn't achieve what I need:

add_field => {
"value-field" => "%{[parsed-json][0][value]}"
"key-field" => "%{[parsed-json][0][key]}"
}

Thank you

[jrihds]

I worked out a solution. I needed to add validation to ensure that the data exists before I try and create a field for it, as below:

if [parsed-json][0] {
mutate {
add_field => {
"%{[parsed-json][0][key]}" => "%{[parsed-json][0][value]}"
}
}
}