Filter mutate add_field to create a nested field

Elastic Stack Logstash
1

Hello,
I am new to logstash and I have a question about creating nested field with the add_field filter

I use logstash 7.17.

I want to create a nested field from a string, but it doesn't work. The other way around (create a string from a nested array), it does work. Here is a snippet of my code :

mutate {
    replace => { 
        "user" => "%{[individual][user]}"
    }
}
mutate {
    add_field => {
        "[user][userType]" => "SUBSCRIBER"
    }
}

[...]

if (![user]) {
    drop {
        id => "No_user"
    }
} else if (![user][userType]) {
    drop {
        id => "No_userType"
    }
}

But this code drop with the id No_userType
I did this code following the documentation about creating a field from a nested_field, and I also tried to create it inside the ruby plugin with event.set from the forum here but I have the same drop

Any help would be appreciated, thank you in advance

2

You should be getting the error message

[2024-04-09T13:39:00,820][WARN ][logstash.filters.mutate ][main][8bc32b302327baed89200cd426ab77a8c3d27a62890a06a7d84f32da3b340613] Exception caught while applying mutate filter {:exception=>"Could not set field 'userType' on object '%{[individual][user]}' to value 'SUBSCRIBER'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string"}

Your first mutate sets [user] to be a string, but your second mutate tries to make it an object with nested fields. You cannot do that. See this thread.

3

Thank you for the response. The following code work :

mutate {
    replace=> {
        "[user][userType]" => "SUBSCRIBER"
    }
}

[...]

if (![user]) {
    drop {
        id => "No_user"
    }
} else if (![user][userType]) {
    drop {
        id => "No_userType"
    }
}