Create new field with metadata content

Elastic Stack Logstash
1

Hey guys,

Thanks to my pipeline, I can extract data and store it to a metadata field :

 if ([ID2] == "000003")
  {
    grok
    {
      match => { "DESCRIPTION" => [ "%{DATA:TEST}/%{WORD:NOM_BATCH}-%{BASE16NUM:DATE_BATCH}-%{GREEDYDATA:RESTE}" ] }
    }
    ruby
    {
      code => "@save_the_date = event.get('DATE_BATCH')"
    }
  }
  else
  {
    ruby
    {
      code => "event.set('DATE_BATCH', @save_the_date)"
    }

So now, how to add_field with @save_the_date content ? because i tried to do :

add_field => {
      "TESTDATE" => "%{@save_the_date}"
    }

But it doesn't work

Can somebody help me ?

Thx for all

2

I don't understand. Your second ruby filter should do exactly what you're looking for.

3

I try to do that because in this case @save_the_date is empty .. Look at my first discussion with Badger on this subject to understand better :

4

Okay, but then the real problem is that @save_the_date is empty, not that you can't save it into a field.

I don't know why you started a new thread. The old problem seems to remain unsolved.

5

Ok thx you for answer I'll solve this one and continue to speak on the other one

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.