Explanation of string interpolation?

Elastic Stack Logstash
1

I cannot find where in the docs it explains how string interpolation with %{myvar} works... Is there an explanation?

I have an "http" output which uses the "mapping" config to control the structure of the output like so:

...
output {
    http {
      keepalive => false
      retry_non_idempotent => true
      automatic_retries => 3
      request_timeout => 10
      socket_timeout => 10
      format => "json"
      http_method => "post"
      url => "https://example.com/data.json"
      content_type => "application/json"
      mapping => { "foo" => "%{foo}"
        "bar" => "%{bar}" }
    }
}

If I have a "foo" in the event, then it works properly. However, if I do not have a "foo", then in my ouput it get the literal string "%{foo}". That's definitely not what I want... it should be a blank string.

Is that expected behavior?

If so, is there a way to populate a default value for something that's missing?

2

I cannot find where in the docs it explains how string interpolation with %{myvar} works... Is there an explanation?

If I have a "foo" in the event, then it works properly. However, if I do not have a "foo", then in my ouput it get the literal string "%{foo}". That's definitely not what I want... it should be a blank string.

Is that expected behavior?

Yes. See Default value for sprintf interpolation (Feature) · Issue #4416 · elastic/logstash · GitHub for a feature request.

If so, is there a way to populate a default value for something that's missing?

There's an example in the GitHub issue above.