Create nested field

Elastic Stack Logstash
1

Hi,

is there a better way to create a nested field than my two step approach? Did not get it to work otherwise.

mutate {
add_field => {
"riemann" => { }
"riemannstate" => "critical"
"riemannservice" => "testservice"
"riemannmetric" => "1.0"
}
}
mutate {
rename => {
"riemannstate" => "[riemann][state]"
"riemannservice" => "[riemann][service]"
"riemannmetric" => "[riemann][metric]"
}
}

2

So

mutate { 
  add_field => {
    "[riemann][state]" => "critical"
    "[riemann][service]" => "testservice"
    "[riemann][metric]" => "1.0"
  }
}

doesn't work?

3

No, unfortunately not. With this approach I get the following result (ls 2.2.2)

{
"message" => "",
"@timestamp" => "2016-04-13T10:04:53.838Z",
"host" => "virtmachine",
"service" => "service",
"metric" => "1.0",
"state" => "critical"
}