Dissect Filter, Creating Subfields

Elastic Stack Logstash
1

Hello,

how can i get dissect to create a structure with subfields?

        dissect {
            mapping => {
                "message" => "%{test.subfield}.%{test.subfield2}"
            }
        }

I would expect so get some output like:

test => {
"subfield" => "somevalue",
"subfield2" => "anothervalue"
}

I tried test.subfield, because grok accpets it this way, but it appears to be different in dissect.
The actual output looks like

"test.subfield" => "somevalue",
"test.subfield2" => "anothervalue"

I hope you can help me out.

2

The way to reference nested fields in logstash is using the [top-level][sub-level] format, both in grok and dissect and in any other filter in logstash.

So to have a field named test with the fields subfield and subfield2 nested under it, you should use [test][subfield] and [test][subfield2].

So, change your dissect to this:

"message" => "%{[test][subfield]}.%{[test][subfield2]}"
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.