Add new field

Elastic Stack Logstash
1

Hello,
I am parsing my data with logstash and I want to add a new field and I want to get it value from the first variable of a hash list called Tps wich I got it from a split of the message.

I've tried this line ut it doesn't work !!

add-field => { "my_new_field" => "%{Tps[0]}" }

this is my full filter

filter {
       if [type] == "1" {
             if "Tps:" in [message] {
                   csv {
                        separator => " Tps: "
                        columns => ["Mat","Tps"]
                    }
                   mutate {
                        split => { "Mat" => " " }
                        remove_field => ["Mat[0]","Mat[1]","Mat[1]","Mat[1]"]
                        split => { "Tps" => " " }
                        remove_field => ["Tps[1]","Tps[1]","Tps[1]"]
                        add-field => { "my_new_field"=> "%{Tps[0]}" }
                   }              
      }else { drop{} }
 }}

Can anyone help me please :slight_smile:

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.