Can not use field from previous http filter

Elastic Stack Logstash
1

Given the following config, I expect db_size to have the same value as body.info.sizes.active.

But it appears the copy can not resolve the nested field body.info.sizes.active.

input {
  http_poller {
    urls => {
      getAllDbs => {
        url => "http://couchdb:5984/_all_dbs"
        method => get
        user => "admin"
        password => "admin"
      }
    }
    request_timeout => 60
    schedule => { cron => "* * * * * UTC}"}
    codec => "plain"
  }
}

filter {
  json {
    source => "message"
    target => "all_dbs"
  }

  split {
    field => "all_dbs"
    target => "db_name"
  }

  http {
    url => "http://couchdb:5984/%{db_name}"
    verb => "GET"
    user => "admin"
    password => "admin"
    target_body => "body.info"
  }

  mutate {
    copy => {"body.info.sizes.active" => "db_size"}
  }
}

image
image.png1148×246 17.8 KB

However, body.info is correctly recognised as hash (I tried to parse it through a json filter, and it failed with message :exception=>java.lang.ClassCastException: org.jruby.RubyHash cannot be cast to org.jruby.RubyIO`)

Am I doing something wrong, is this normal behaviour?

2

If it is a nested field then the syntax to reference it in logstash is

[body][info][sizes][active]
3

I already tried using [body][info][sizes][active], but the result is the same: db_size is empty

4

Sorry about that, it is probably

[body.info][sizes][active]
5

[body.info][sizes][active] that's working!
Thak you Badger

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.