Dynamic add_field in metrics

Elastic Stack Logstash
1

I've a logstash conf file like the following:
input {
generator {
type => "generated"
}
}

filter {
metrics {
type => "generated"
meter => "foo"
add_tag => "metric"
add_field => [ "foo", "Hello world, from %{host}" ]
}
}

output {
if [type] != "generated" {
stdout {
debug => true
}
}
}

that produces the following output:

{
"@timestamp" => "2017-07-28T11:00:01.123Z",
"@version" => "1",
"message" => "27b0c651-0dc0-4910-8c6f-98778e76f2b3",
"foo.count" => 1,
"foo.rate_1m" => 0.0,
"foo.rate_5m" => 0.0,
"foo.rate_15m" => 0.0,
"foo" => "Hello world, from %{host}",
"tags" => [
[0] "metric"
]
}

Instead of having the string "%{host}" I would like to have the resolved host name.
Unfortunately this doesn't happen. Not resolving the dynamic field in metrics seems to be an old bug of logstash (isn't it ?).

Unfortunately I don't have any clue about how to resolve it.
Is there anybody that could provide me a solution ? A workaround is also very well accepted.

Thanks a lot in advance

2

Instead of having the string “%{host}” I would like to have the resolved host name.

%{host} doesn't expand because the event doesn't have a host field.

  • If you store the hostname in an environment variable you can replace %{host} with ${HOSTNAME} (or whatever the variable is named).
  • You can use a ruby filter to obtain the hostname and add it as a field.
  • What input plugin are you really planning on using as presumably the generator input is just for testing? Many real input plugins add a host field.
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.