Field reference with a split event

[jiacob]

Hello,

I'm looking into trying to split a nested field that uses a field reference and I'm not sure which is the right way of doing it.

split { field => "[field1][field2]['%{[field3]}']" }

This gives me a field reference error and causes the logstash instance to crash.

[Badger]

I think you would need to use ruby to do that reference. I have not tested it, but something like

ruby {
    code => '
        fieldName = event.get("field3")
        someObject = event.get("[field1][field2]")
        value = someObject[fieldName]
        event.set("[@metadata][value]", value)
    '
}
split { field => "[@metadata][value]" }
ruby {
    code => '
        fieldName = event.get("field3")
        value = event.get("[@metadata][value]")
        event.set("[field1][field2][#{fieldName}]", value)
    '
}

You would have to add tests so that if event.get returns nil the code does not blow up.