Ambiguous field reference for object field

Elastic Stack Logstash
1

Hi,

I'm attempting to split a field which looks like:

{
  "VERSION" : "version-uk-v2.1.0-global-v2.2.0" 
}

into the following:

{
  "host" : {
    "version" : {
      "uk" : "v2.1.0",
      "global" : "v2.2.0"
    }
  }
}

I need to be able to reference the field value when setting the new field name since "uk" is variable. Here is the filter I'm using:

  if [VERSION] {
    mutate {
      split => ["VERSION", "-"]
      add_field => { "[host][version][%{[VERSION][1]}]" => "%{[VERSION][2]}" }
      add_field => { "[host][version][%{[VERSION][3]}]" => "%{[VERSION][4]}" }
      remove_field => [ "VERSION" ]
    }
  }

It seems to work, but it results in the warnings:

[2019-11-01T12:42:31,790][WARN ][org.logstash.FieldReference] Detected ambiguous Field Reference [host][version][%{[VERSION][1]}], which we expanded to the path [host, version, %{, VERSION, 1, }]; in a future release of Logstash, ambiguous Field References will not be expanded.
[2019-11-01T12:42:31,791][WARN ][org.logstash.FieldReference] Detected ambiguous Field Reference [host][version][%{[VERSION][3]}], which we expanded to the path [host, version, %{, VERSION, 3, }]; in a future release of Logstash, ambiguous Field References will not be expanded.

I've tried referencing those array elements a number of different ways but the warning still remains. What is the correct way to do this?

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.