Decorate_events returns the literal strin

I'm trying to use the decorate_events feature in logstash to pull kafka details and put them into Elastic search. The issue is, in Elastic search, the value is being set to "%{[metadata][kafka][topic]}" rather than the topic name. Any suggestions on what I'm doing wrong?

Config as below:
Input {
kafka {
bootstrap_servers => "XXXX"
topics => ["testTopic"]
group_id => "testgroup"
decorate_events => true

filter {

     json {
      source => "message"

     mutate { add_field => { "kafkaT" => "%{[metadata][kafka][topic]}" } }


That should be %{[@metadata][kafka][topic]}

Thanks for the quick reply but that doesn't seem to work either. Now it returns %{[@metadata][kafka][topic]}

Any other ideas?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.