Append nested variable's value to a string

I'm trying to setup a bit of a dynamic solution to the logstash config, and especially the json filter part. When setting the json part, I need to provide a source and a target fields. With source it's easy, however, the target field should be a bit dynamic, i.e in my case, based on another field value. For example, I have a nested field [kubernetes][container][name], and the following json configuration:

              json {
                source => "message"
                target => "message_json_%{[kubernetes][container][name]}"
                skip_on_invalid_json => true

As you can see, I'm trying to append the nested value to the string in the target, however, it seems that no matter how I will mutate my target, it's always results in errors.
Can someone please help me figure this one out?
Thanks in advance!


The filter does not sprintf the value of the target option, so you cannot do this directly. You would have to use a constant field name for the target (possibly under @metadata) and then use mutate+rename.

Hey Badger, thanks for the info. Can you perhaps help me out with an example on how to do so? I'm a bit lost in it.

Bumping up again.
@Badger hope you can help with this, thank you in advance!


target => "foo"

and then

mutate { rename => { "foo" => "message_json_%{[kubernetes][container][name]}" } }

Thanks a lot @Badger, worked like a charm!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.