Combining Field Values Into New Field

Elastic Stack Logstash
1

Using the below in pipeline:

  mutate {
    add_field => {
      "geoip.location.coordinates" => "%{geoip.location.lat},%{geoip.location.lon}"
    }
  }

Does not result in something like 37.425,-122.00 but rather %{geoip.location.lat},%{geoip.location.lon}. What am I doing wrong?

2

Should be...

  mutate {
    add_field => {
      "[geoip][location][coordinates]" => "%{[geoip][location][lat]},%{[geoip][location][lon]}"
    }
  }

Hopefully that helps.

Rob

Robert Cowart (rob@koiossian.com)
www.koiossian.com
True Turnkey SOLUTIONS for the Elastic Stack

3

That did it, thanks a lot!