Combine parsed fields


(Adrian Martin) #1

add_field => { "host_device_name" => "%{host} %{fs.device_name}" }

gives me host_device_name:"my-machine %{fs.device_name}"

How/Can I referfence the already parsed values?


(Christian Dahlqvist) #2

I don't think you can use dot notation there. Try the following instead:

add_field => { "host_device_name" => "%{host} %{[fs][device_name]}" }


(Adrian Martin) #3

Thanks that worked.


(system) #4