How to get the diff value of 2 fields and set it to a new field

I want to reference a field in FileBeat to calculate the difference between them.

  - dissect:
      tokenizer: '"%{licence}","%{system}","%{part}","%{uses|integer}","%{users|integer}"'
      field: "message"
      target_prefix: "data"
  - add_fields:
      target: data
        name: %{data.uses} - %{data.users}

But that config is not allowed.

As Scripted field are deprecated, how should I solve this issue now?

I cannot find any solution in the forum. What is the best best to get the diff of 2 fields?

Hi @kwoxer!

Maybe you can use script-processor for this.


1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.