Creating a temporary variable in logstash

[joconner (John O'Conner)]

As I experiment with logstash, I have tried to create temporary variables to hold data that I hope to later use to use in an add_field statement. However, I often see configuration errors when I try to do this.

How does one create temporary variables in logstash? Not new tags or fields, but just temporary variables?

Thanks.

[magnusbaeck (Magnus Bäck)]

Variables that persist between events? There's no "official" way to do that from the Logstash configuration language. It either needs to be explicitly implemented in a plugin or I think you can use a ruby filter like this:

ruby {
  init => "@counter = 0"
  code => "
    @counter += 1
    event.set('message_count', @counter)
  "
}

[joconner (John O'Conner)]

Thank you for your rapid response. No, I'm not thinking about persistent variables, just variables that I can use during the processing of a single event.

[magnusbaeck (Magnus Bäck)]

Oh. Then you can store them as subfields to @metadata. They work like regular fields except they won't be passed on to outputs.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#metadata