Creating an array field with mutate

Elastic Stack Logstash
1

Hi,

I am writing logstash filters for log parsing, and at one step I am using elasticsearch input plugin. The elastic search input plugin expects hosts as an array.

Now, I am trying to access the hosts values as field. I have a mutate filter up in the chain that sets the values -
mutate {
add_field => {"es_host" => [":"}
add_field => {"es_user" => ""}
add_field => {"es_passwd" => ""}
}

And then I try to access it as follows -

elasticsearch {
hosts => [es_host]
user => "%{es_user}"
password => "%{es_passwd}"
query => "my_query"
}

Now, no matter what I do, es_host never gets passed as an array.
add_field => {"es_host" => ":"} , hosts => ["%{es_host}"]
add_field => {"es_host" => ":"} , hosts => [[es_host]]
add_field => {["es_host"] => ":"} , hosts => [es_host]

And even setting the es_host via ruby filter, but no luck. Every time it take es_host as a literal and try to append the port by itself (http://es_host:9200) .

Any clue?

Thanks
-Nilesh

2

Yeah, I don't think this is possible.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.