Cannot reference a field inside string

Elastic Stack Logstash
1

Hello,

I'm trying to reference a field from a string inside the output section of my configuration. Instead of the field value, what I get is the literal representation of the string; in this case: '%{myfield}'. Here is the simplified version of my configuration containing only the related information:

input {
    tcp {
            ...
    }
}

filter {
    if [somefield] == "something" {
                ...
        if [somefield2] =~ someregex {
            ...
            mutate {
                rename => { "somefield3" => "myfield" }
            }
           ...
        } else {
            drop {}
        }

    }

}

output {
    if "_jsonparsefailure" in [tags] {
        ...
    } else {
        ...
        rabbitmq {
            ...
            message_properties => {
              "content_type" => "application/json"
              "priority" => 1
              "app_id" => "%{myfield}"
            }
            ...
        }
    }
}
1 Like
2

(bump) I'm still struggling with this issue. Any ideas?

3

That probably means that your mutate filter that creates the myfield field does not run (due to conditional) or that there at that point is no somefield3 that can be renamed.

4

Actualy somefield3 exists and rename mutation renames it to myfield. I'm validating by parsing the JSON output. But I can't reference the field in a string for some reason.

5

It may be that the rabbitmq plugin does not support that.

6

Seems like it. I'll open a feature request on GitHub.

EDIT: Cannot reference a field inside string #25

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.