Hey guys, Thanks to my pipeline, I can extract data and store it to a metadata field : if ([ID2] == "000003") { grok { match => { "DESCRIPTION" => [ "%{DATA:TEST}/%{WORD:NOM_BATCH}-%{BASE16NUM:DATE_BATCH}-%{GREEDYDATA:RESTE}" ] } } ruby { code => "@save_the_date …

Okay, but then the real problem is that @save_the_date is empty, not that you can't save it into a field. I don't know why you started a new thread. The old problem seems to remain unsolved.

Discuss the Elastic Stack

Create new field with metadata content

Elastic Stack Logstash

dyl (bus) June 15, 2018, 1:49pm 3

I try to do that because in this case @save_the_date is empty .. Look at my first discussion with Badger on this subject to understand better :

Topic		Replies	Views
Logstash not creating new field Logstash	3	1180	January 20, 2017
I want to combine field Logstash	3	280	April 23, 2021
Add or update field in filter or elsewhere Logstash	4	2498	December 4, 2017
I want to add new field and replace the one of the existing field value to the newly added field Logstash	1	283	September 13, 2019
Add_field => [ "EventDate", "%{@timestamp}" ] Logstash	3	7075	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Create new field with metadata content

Related topics