Field reference with a split event

Hello,

I'm looking into trying to split a nested field that uses a field reference and I'm not sure which is the right way of doing it.

split { field => "[field1][field2]['%{[field3]}']" }

This gives me a field reference error and causes the logstash instance to crash.

I think you would need to use ruby to do that reference. I have not tested it, but something like

ruby {
    code => '
        fieldName = event.get("field3")
        someObject = event.get("[field1][field2]")
        value = someObject[fieldName]
        event.set("[@metadata][value]", value)
    '
}
split { field => "[@metadata][value]" }
ruby {
    code => '
        fieldName = event.get("field3")
        value = event.get("[@metadata][value]")
        event.set("[field1][field2][#{fieldName}]", value)
    '
}

You would have to add tests so that if event.get returns nil the code does not blow up.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.