Hi all,
I need to add a value to a field from a variable within a grok filter.
filter {
grok {
match => [ "message", "(?<ts>(.*?))\t(?<uids>(.*?))" ]
}
mutate { add_field => { "container_id" => "%{uids}" } }
}
The field is created but the value is not taken into consideration it simply puts the string %{uids}.
How should I add the value from this grok variable to a field?
Thank you!