# How to get filter value metadata in input
**URL:** https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674
**Category:** Logstash
**Created:** [June 4, 2020, 6:06am UTC](https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674 "2020-06-04T06:06:05Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)
#### Post date: [June 4, 2020, 6:06am UTC](https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674/1 "2020-06-04T06:06:06Z")
Hi Guys,
input{
kafka {
bootstrap\_servers =\> "172.20.188.11:9092,172.20.188.31:9092,172.20.188.30:9092"
topics =\> ["DS\_Test"]
decorate\_events =\> true
group\_id =\> "ds\_test"
codec =\> json
max\_poll\_records =\> "100"
consumer\_threads =\> 2
session\_timeout\_ms =\> "30000"
auto\_offset\_reset =\> "earliest"
client\_id =\> "logstash-ingestion"
}
}
filter {
mutate { remove\_field =\> "@Version" }
mutate { remove\_field =\> "@timestamp" }
mutate { add\_field =\> { "[@metadata][index]" =\> "%{[eventHeader][bpcName]}_%{[eventHeader][applicationId]}"} }
mutate { add\_field =\> { "[@metadata][ObjectCode]" =\> "%{[eventHeader][applicationId]}_%{[eventHeader][objectCode]}"} }
mutate { add\_field =\> { "[@metadata][action]" =\> "%{[event][action]}"} }
mutate { add\_field =\> { "[@metadata][applicationId]" =\> "%{[eventHeader][applicationId]}"} }
mutate { add\_field =\> { "[@metadata][itemId]" =\> "%{[eventData][itemId]}"} }
mutate { add\_field =\> { "[@metadata][isDeleted]" =\> "%{[eventData][isDeleted]}"} }
mutate { gsub =\> ["[@metadata][action]","INSERT","index"] }
mutate { gsub =\> ["[@metadata][action]","Insert","index"] }
mutate { gsub =\> ["[@metadata][action]","UPDATE","update"] }
mutate { gsub =\> ["[@metadata][action]","Update","update"] }
mutate { gsub =\> ["[@metadata][action]","DELETE","delete"] }
mutate { gsub =\> ["[@metadata][action]","Delete","delete"] }
mutate { remove\_field =\> "[logstash]" }
mutate { remove\_field =\> "[metadata]" }
mutate { remove\_field =\> "[eventHeader]" }
mutate { remove\_field =\> "[event]" }
json{
source =\> "message"
}
ruby {
code =\> '
details\_hash = event.get("eventData")
return if details\_hash.nil?
details\_hash.each do |k, v|
event.set(k,v)
end
event.remove("eventData")
hash = event.to\_hash
hash.each {|k,v|
data = event.get(k)
return if data.nil?
event.set(k,v)
}'
}
json{ source=\>"message" }
}
input {
http\_poller {
urls =\> {
soap\_request =\> {
method =\> post
url =\> "[https://dm-dev-authenticationservice-serviceapps-use-rg.azurewebsites.net/api/v1/Token](https://dm-dev-authenticationservice-serviceapps-use-rg.azurewebsites.net/api/v1/Token)"
headers =\> {
"Content-Type" =\> "application/json"
}
body =\>
'{"ClientId":"%[@metadata][itemId]"}'
}
}
request\_timeout =\> 60
# Supports "cron", "every", "at" and "in" schedules by rufus scheduler
schedule =\> { cron =\> "\* \* \* \* \* UTC"}
codec =\> "json"
# A hash of request metadata info (timing, response headers, etc.) will be sent here
metadata\_target =\> "http\_poller\_metadata"
}
}
output{
if [@metadata][applicationId] == "62"
{
elasticsearch {
hosts =\> "[http://172.20.188.15:9200](http://172.20.188.15:9200)"
user =\> "elastic"
password =\> "changeme"
index =\> "%{[@metadata][index]}"
document\_id =\> "%{[@metadata][ObjectCode]}"
action =\> "%{[@metadata][action]}"
}
}
stdout { codec =\> rubydebug { metadata =\> true} }
}
this is my config file I want [@metadata][itemId] needs to be replcae in body section
body =\>
'{"ClientId":"%[@metadata][itemId]"}'
like body =\>
'{"ClientId":"123"}'
---
### Author:  [@tamilsweet](https://discuss.elastic.co/u/tamilsweet)
#### Post date: [June 4, 2020, 6:11am UTC](https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674/2 "2020-06-04T06:11:24Z")
Please use formatting so that your question is readable.
I think you just have to change
```auto
'{"ClientId":"%[@metadata][itemId]"}'
```
to
```auto
'{"ClientId":"%{[@metadata][itemId]}"}'
```
---
### Author:  [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)
#### Post date: [June 4, 2020, 6:15am UTC](https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674/3 "2020-06-04T06:15:42Z")
> [@tamilsweet](#):
>
> `'{"ClientId":"%{[@metadata][itemId]}"}'`
Hi Thanks,
for quick responce still its not working for me,
its showing below content
"body" =\> "{"ClientId":"%{[@metadata][itemId]}"}",
can we use filter data inside input?
---
### Author:  [@tamilsweet](https://discuss.elastic.co/u/tamilsweet)
#### Post date: [June 4, 2020, 6:23am UTC](https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674/4 "2020-06-04T06:23:52Z")
Can you please format the config in your question?
Cannot figure out where the config starts and ends.
Start and end config block with 3 backticks (`)
---
### Author:  [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)
#### Post date: [June 4, 2020, 6:42am UTC](https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674/7 "2020-06-04T06:42:10Z")
```auto
input{
kafka {
bootstrap_servers => "172.20.188.11:9092,172.20.188.31:9092,172.20.188.30:9092"
topics => ["DS_Test"]
decorate_events => true
group_id => "ds_test"
codec => json
max_poll_records => "100"
consumer_threads => 2
session_timeout_ms => "30000"
auto_offset_reset => "earliest"
client_id => "logstash-ingestion"
}
}
filter {
mutate { remove_field => "@Version" }
mutate { remove_field => "@timestamp" }
mutate { add_field => { "[@metadata][index]" => "%{[eventHeader][bpcName]}%{[eventHeader][applicationId]}"} }
mutate { add_field => { "[@metadata][ObjectCode]" => "%{[eventHeader][applicationId]}%{[eventHeader][objectCode]}"} }
mutate { add_field => { "[@metadata][action]" => "%{[event][action]}"} }
mutate { add_field => { "[@metadata][applicationId]" => "%{[eventHeader][applicationId]}"} }
mutate { add_field => { "[@metadata][itemId]" => "%{[eventData][itemId]}"} }
mutate { add_field => { "[@metadata][isDeleted]" => "%{[eventData][isDeleted]}"} }
mutate { gsub => ["[@metadata][action]","INSERT","index"] }
mutate { gsub => ["[@metadata][action]","Insert","index"] }
mutate { gsub => ["[@metadata][action]","UPDATE","update"] }
mutate { gsub => ["[@metadata][action]","Update","update"] }
mutate { gsub => ["[@metadata][action]","DELETE","delete"] }
mutate { gsub => ["[@metadata][action]","Delete","delete"] }
mutate { remove_field => "[logstash]" }
mutate { remove_field => "[metadata]" }
mutate { remove_field => "[eventHeader]" }
mutate { remove_field => "[event]" }
ruby {
code => '
details_hash = event.get("eventData")
return if details_hash.nil?
details_hash.each do |k, v|
event.set(k,v)
end
event.remove("eventData")
hash = event.to_hash
hash.each {|k,v|
data = event.get(k)
return if data.nil?
event.set(k,v)
}'
}
json{ source=>"message" }
}
input {
http_poller {
urls => {
soap_request => {
method => post
url => "https://dm-dev-authenticationservice-serviceapps-use-rg.azurewebsites.net/api/v1/Token"
headers => {
"Content-Type" => "application/json"
}
body =>
'{"ClientId":"%[@metadata][itemId]"}'
}
}
request_timeout => 60
schedule => { cron => "* * * * * UTC"}
codec => "json"
metadata_target => "http_poller_metadata"
}
}
output{
if [@metadata][applicationId] == "62"
{
elasticsearch {
hosts => "http://172.20.188.15:9200"
user => "elastic"
password => "changeme"
index => "%{[@metadata][index]}"
document_id => "%{[@metadata][ObjectCode]}"
action => "%{[@metadata][action]}"
}
}
stdout { codec => rubydebug { metadata => true} }
}
please find formatted config
```
---
### Author:  [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)
#### Post date: [June 4, 2020, 6:45am UTC](https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674/8 "2020-06-04T06:45:29Z")
> [@Pankaj\_Jadhav](#):
>
> ```auto
> body =>
> '{"ClientId":"%[@metadata][itemId]"}'
>
> ```
I want to assign value to ClientId which is [@metadata][itemId] value .
want to understand can we assign filter value inside input
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 4, 2020, 1:29pm UTC](https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674/9 "2020-06-04T13:29:41Z")
> [@Pankaj\_Jadhav](#):
>
> ```auto
> body =>
> '{"ClientId":"%[@metadata][itemId]"}'
>
> ```
I do not think this will work. The url (including the options hash which contains the body option) is passed to the Manticore library that logstash uses. logstash does not sprintf the option before passing it, so sprintf references like this will not get expanded.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 2, 2020, 1:29pm UTC](https://discuss.elastic.co/t/how-to-get-filter-value-metadata-in-input/235674/10 "2020-07-02T13:29:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.