How to concatenate two fields in logstash?

I have json format data. I want to concatenate firstName and LastName.

I have tried by using mutate filter

filter{
    mutate { 
        add_field => { 
            "Full Name" => "%{FirstName}%{LastName}"
        } 
    }
}

But I am getting exactly the same in the output
like this, "Full Name" => "%{FirstName}%{LastName}"

My JSON file format is

{
   "Details":{
      "FirstName":"Padam",
      "LastName":"Rai",
      "City":"Umermot"
   }
}

I think it is not working because of nesting. I am getting this format from RabbitMQ

Your first and last name fields are nested under details so when you are trying to lookup FristName and LastName in your FullName field it can't find them unless you add Details first.

filter{
    mutate { 
        add_field => { 
            "FullName" => "%{[Details][FirstName]} %{[Details][LastName]}"
        } 
    }
}

Thank You, Dear, it works.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.