How to concatenate two fields in logstash?

Elastic Stack Logstash
1

I have json format data. I want to concatenate firstName and LastName.

I have tried by using mutate filter

filter{
    mutate { 
        add_field => { 
            "Full Name" => "%{FirstName}%{LastName}"
        } 
    }
}

But I am getting exactly the same in the output
like this, "Full Name" => "%{FirstName}%{LastName}"

My JSON file format is

{
   "Details":{
      "FirstName":"Padam",
      "LastName":"Rai",
      "City":"Umermot"
   }
}

I think it is not working because of nesting. I am getting this format from RabbitMQ

2

Your first and last name fields are nested under details so when you are trying to lookup FristName and LastName in your FullName field it can't find them unless you add Details first.

filter{
    mutate { 
        add_field => { 
            "FullName" => "%{[Details][FirstName]} %{[Details][LastName]}"
        } 
    }
}
3

Thank You, Dear, it works.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.