Detected ambiguous Field Reference warning

I've got to ingest (logstash 6.7) documents which are stages of a workflow (queue_in, start_work, end_work, queue_out, etc.).
I need to add various fields with elapsed times (looking for initial times in previous docs), depending on the stage the workflow.

So I assign the literal string name to a @metadata field:
add_field => { "[@metadata][deltaT_fieldname]" => "<literal field name>" }
I compute the elapsed time and put it in a generic [delta_sec] field using a ruby plugin, then assign its value to the field specified in deltaT_fieldname:

mutate { add_field => { "%{[@metadata][deltaT_fieldname]}" => "%{[@metadata][delta_sec]}"} }

The warn is Detected ambiguous Field Reference `%{[@metadata][deltaT_fieldname]}`, which we expanded to the path `[%{, @metadata, deltaT_fieldname, }]`; in a future release of Logstash, ambiguous Field References will not be expanded.

I've read through other similar issues like this, or the grammar by @yaauie, but still don't understand how to fix my "sprintf" format string.

Any suggestion, to keep it working with newer logstash versions?

logstash 6.7 is EOL and no longer supported. Please upgrade ASAP.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.