Combine two fields into one via add_fields

Hey everyone.

I am trying to achieve something seemingly simple but cannot get this to work with the latest Filebeat 7.10:

I want to combine the two fields and foo.baz into a single new field that just joins the strings.

so { "x", foo.baz: "y" }

will become: { new: "combine-x-y" }

My processor:

 - add_fields:
      when.has_fields: ["", "foo.baz"]
        new: "combine-${}-${}"

which will result in:

Exiting: error initializing processors: fail to unpack the add_fields configuration: missing field accessing '' 

I tried all different interpolation styles (%{[]} or ${foo} instead of ${}) but none of them worked.

Am I missing something obvious?

Hi @bascht, welcome to the Elastic community forums!

I don't believe this is possible. You may want to look into the Script Processor instead.


Interesting, thanks for the hint! It looks quite complex but I'm gonna give it a try! :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.