Thanks a lot Rom1! I hade to change it to
add_field => {
"@name" => "%{[_source][doc][name]}"
"@state" => "%{[_source][doc][state]}"
}
But the problem is, there is still nothing sent to Elasticsearch. I tried to change the output of elasticsearch to this:
elasticsearch {
hosts => "localhost"
index => "services-%{+YYYY.MM.dd}"
user => "elastic"
password => "*****"
}
Now it creates at least the index, but there are no fields in it.