How to get the value of a key in the created field using add_fields processor?

[musician]

Hello,

I am using metricbeat 7.6.2 on Windows 2012. I have the following system.yml:

- module: system
  period: 10s
  metricsets:
    - cpu
    - memory
    - process
  processes: ['^metricbeat.exe$']
  processors:
   - add_fields:
        when:
            and:
                - has_fields: ['system.process.cpu.total.norm.pct']
                - range: 
                    system.process.cpu.total.norm.pct.gte: 0.0
        target: performance_issue
        fields:
          id: 'cpu'
          threshold: '0.0'
          val: system.process.cpu.total.norm.pct

I would like to get the value of the key system.process.cpu.total.norm.pct in the "val" key in the created JSON element show as below:

"performance_issue" : {
            "val" : "system.process.cpu.total.norm.pct",
            "threshold" : "0.0",
            "id" : "cpu"
          }

How would I change the system.yml file so that I can achieve this?

[ChrsMark (Chris Mark)]

Hi @musician!

Could you try to define it as string like: val: 'system.process.cpu.total.norm.pct'?

Resource: https://www.elastic.co/guide/en/beats/filebeat/current/add-fields.html

[Sheli1a]

This allows to use advanced features like statistical analysis on value fields!

[ChrsMark (Chris Mark)]

So you want the value of this field, and not the "name" of the field, right? Sorry I misunderstood the case. In cases like this, for special field handling I suggest script-processor.

[musician]

OK - great. Thanks for the response. I will explore using script processor.