Assigning value to add_field new field

Elastic Stack Logstash
1

Hi,

I get the field defined in filebeat.yml file as:

paths:
- /var/logs/mylog.log
document_type: LOG1
fields:
mytype: FORMAT1

,defining different format spec for each of the log files in the overall group of log files ...

Now I need to take this in the logstash filter and use it for new variables / fields; I can reference it inside the logstash filter as:
...
[fields][mytype] - I can check it inside the 'if' statements, etc ..

How do I assign the value of that file to the new filed created in the mutate section using add_field:
add_field => { "NEWFIELD", [fields][mytype] } - this did not work - what is the correct syntax for this ?

I also tried referencing it with %{[field][mytype]} - but that did not work either:
add_field => { "NEWFIELD", %{[fields][mytype]} }

Thanks in advance!

2

I mean - "How do I assign the value of that field to the new field created in the mutate" - sorry for the typo

3 
add_field => { "NEWFIELD", "%{[fields][mytype]}" }

See https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references for more examples.

You might also want to use a mutate filter and its rename option if you want to move a field. With add_field you'll end up with two fields with the same contents.

Another option is to configure Filebeat to store the extra fields at the root of the event rather than as subfields of fields. See Filebeat's fields_under_root option.

1 Like
4

I was missing outside double quotes in "%{[fields][mytype]}" - thank you Magnus!