Hello,
I've got to ingest (logstash 6.7) documents which are stages of a workflow (queue_in, start_work, end_work, queue_out, etc.).
I need to add various fields with elapsed times (looking for initial times in previous docs), depending on the stage the workflow.
So I assign the literal string name to a @metadata field:
add_field => { "[@metadata][deltaT_fieldname]" => "<literal field name>" }
I compute the elapsed time and put it in a generic [delta_sec] field using a ruby plugin, then assign its value to the field specified in deltaT_fieldname:
mutate { add_field => { "%{[@metadata][deltaT_fieldname]}" => "%{[@metadata][delta_sec]}"} }
The warn is Detected ambiguous Field Reference `%{[@metadata][deltaT_fieldname]}`, which we expanded to the path `[%{, @metadata, deltaT_fieldname, }]`; in a future release of Logstash, ambiguous Field References will not be expanded.
I've read through other similar issues like this, or the grammar by @yaauie, but still don't understand how to fix my "sprintf" format string.
Any suggestion, to keep it working with newer logstash versions?
)