Decorate_events returns the literal strin

Elastic Stack Logstash
1

Hi,
I'm trying to use the decorate_events feature in logstash to pull kafka details and put them into Elastic search. The issue is, in Elastic search, the value is being set to "%{[metadata][kafka][topic]}" rather than the topic name. Any suggestions on what I'm doing wrong?

Config as below:
Input {
kafka {
bootstrap_servers => "XXXX"
topics => ["testTopic"]
group_id => "testgroup"
decorate_events => true
}
}

filter {

     json {
      source => "message"
      }

     mutate { add_field => { "kafkaT" => "%{[metadata][kafka][topic]}" } }

}
Thanks
Miraj

2

That should be %{[@metadata][kafka][topic]}

3

Thanks for the quick reply but that doesn't seem to work either. Now it returns %{[@metadata][kafka][topic]}

Any other ideas?
Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.