Append nested variable's value to a string

Elastic Stack Logstash
1

Hello,
I'm trying to setup a bit of a dynamic solution to the logstash config, and especially the json filter part. When setting the json part, I need to provide a source and a target fields. With source it's easy, however, the target field should be a bit dynamic, i.e in my case, based on another field value. For example, I have a nested field [kubernetes][container][name], and the following json configuration:

              json {
                source => "message"
                target => "message_json_%{[kubernetes][container][name]}"
                skip_on_invalid_json => true
              }

As you can see, I'm trying to append the nested value to the string in the target, however, it seems that no matter how I will mutate my target, it's always results in errors.
Can someone please help me figure this one out?
Thanks in advance!

2

Anyone?

3

The filter does not sprintf the value of the target option, so you cannot do this directly. You would have to use a constant field name for the target (possibly under @metadata) and then use mutate+rename.

4

Hey Badger, thanks for the info. Can you perhaps help me out with an example on how to do so? I'm a bit lost in it.

5

Bumping up again.
@Badger hope you can help with this, thank you in advance!

6

Use

target => "foo"

and then

mutate { rename => { "foo" => "message_json_%{[kubernetes][container][name]}" } }
7

Thanks a lot @Badger, worked like a charm!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.