How to adress [fields][env] (f.e.) if i want to combine them into a single string

[Dennis_Bohs (Dennis B)]

Hi there,
i hope this is a simple question and i just can't find it in the documentation:
I have several fields, that i'd adress by [fields][something] in logstash.
Now i want to write an email-alert (with output email) and would like to put the content of those fields into the subject of that mails.
Now that subject-field accepts a string like add_fields does aswell, but if i do something like

subject => "%{fields.env} %{fields.loglevel} %{agent.hostname} %{log.file.path}"

it does not replace those tags.
How would i adress those fields?

[ITIC (Jordi)]

Hi

The right way is with square brackets:

subject => "%{[fields][env]} %{[fields][loglevel]} %{[agent][hostname]} %{[log.file][path]}"

Hope this helps

[Dennis_Bohs (Dennis B)]

yes, this does do the trick. thank you!