Add new field based on another field

Elastic Stack Logstash
1

Hello.
I have such field in filebeat output docker.container.labels.app
it looks like this:

    "docker" => {
        "container" => {
                "id" => "7549e137-3394-987d-f3cc-f79759851a62",
                "labels" => {
                    "app" => "app1",
                    "env" => "production",
        }
     }

I want to set another field in logstash based on this field - docker.container.labels.app
I have such configuration:

filter {
        if ("" in [docker.container.labels.app]) {
            mutate {
                add_field => { "app" => "unknown" }
            }
        } else {
            mutate {
                add_field => { "app" => [docker.container.labels.app] }
            }
        }
}

But it doesn't work. Can you help me ?

2

Sorry. I found the solution.

add_field => { "app" => "%{[docker][container][labels][app]}"

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.