Having trouble assigning value from field A to field B

Elastic Stack Logstash
1

We have a field [env_id] which is sent from filebeat. In logstash, I want to assign this value to field, [topic][env], but am failing miserably. Here's the latest that I've tried which doesn't work. This should be straightforward, but for some reason, I am completely baffled?

 mutate {
   replace => [ "[topic][env]", "%{[env_id]}" ]
}
2

It works for me.

filter {
    mutate { add_field => { "env_id" => "foo" } }
    mutate { replace => [ "[topic][env]", "%{[env_id]}" ] }
}

gets me

        "env_id" => "foo",
         "topic" => {
        "env" => "foo"
    },

What does it look like for you?

3

What do you get? Use a stdout { codec => rubydebug } output to dump a raw event (or copy/paste from Kibana's JSON tab).

4

It works. Not sure what bonehead thing I was doing. Thanks!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.