I want to reference a field in FileBeat to calculate the difference between them.
- dissect:
tokenizer: '"%{licence}","%{system}","%{part}","%{uses|integer}","%{users|integer}"'
field: "message"
target_prefix: "data"
- add_fields:
target: data
fields:
name: %{data.uses} - %{data.users}
But that config is not allowed.
As Scripted field are deprecated, how should I solve this issue now?
I cannot find any solution in the forum. What is the best best to get the diff of 2 fields?