Hey guys, Thanks to my pipeline, I can extract data and store it to a metadata field : if ([ID2] == "000003") { grok { match => { "DESCRIPTION" => [ "%{DATA:TEST}/%{WORD:NOM_BATCH}-%{BASE16NUM:DATE_BATCH}-%{GREEDYDATA:RESTE}" ] } } ruby { code => "@save_the_date …

Okay, but then the real problem is that @save_the_date is empty, not that you can't save it into a field. I don't know why you started a new thread. The old problem seems to remain unsolved.

Discuss the Elastic Stack

Create new field with metadata content

Elastic Stack Logstash

dyl (bus) June 15, 2018, 1:49pm 3

I try to do that because in this case @save_the_date is empty .. Look at my first discussion with Badger on this subject to understand better :

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.