Add new field based on value in event_data

(Micke) #1

Trying to add a new field IF event_data.Status is a specific value. Cant figure out the syntax for Logstash.


(Andrew Kroh) #2

You can use a conditional mutate filter.

filter {
  if [event_data][Status] == "some value" {
    mutate {
        add_field => [ "myfield", "foobar" ]

(Micke) #3

Thanks alot Andrew, just now found the exact same solution.
Appreciate it!!!

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.