Detected ambiguous Field Reference. How to fix it exactly?

Elastic Stack Logstash
1

Hi

LogStash 6.6.2

I see several topics with similar questions, but answers are unclear to me. So I ask again.
In my filters, I have this

mutate { add_field => { "executionhost" => "%{host[name]}" } }

mutate {
    split => ["source", "/"]
    add_field => { "logfile" => "%{source[-1]}"  }
}

It works fine, JSON output includes the hostname and the log filename.
However, it triggers these 2 warning messages:

[WARN ] 2019-04-02 11:38:55.217 [[main]>worker0] FieldReference - Detected ambiguous Field Reference `host[name]`, which we expanded to the path `[host, name]`; in a future release of Logstash, ambiguous Field References will not be expanded.

[WARN ] 2019-04-02 11:38:55.255 [[main]>worker0] FieldReference - Detected ambiguous Field Reference `source[-1]`, which we expanded to the path `[source, -1]`; in a future release of Logstash, ambiguous Field References will not be expanded.

If I change, for example the first one, like this:

mutate { add_field => { "executionhost" => "[host, name]" } }

Only thing I get in the json output is this:

"executionhost" => "[host, name]",

So, must I change the original code? If yes, how exactly?

Cheers,
Jose

2

If host is an object that contains a nested object called name then

mutate { add_field => { "executionhost" => "%{[host][name]}" } }
1 Like
3

Perfect!!
Thanks a lot.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.