I have to concatenate below two fields

Elastic Stack Logstash
1

%{URIPATH:url}%{DATA:[status]}
I am using this but not success add_field => ["%{DATA:actual-url}", "%{URIPATH:url} %{DATA:[status]}"]

2

If you have use a grok pattern to create two fields called url and status then you would combine them using

mutate { add_field => { "actual_url" => "%{url}%{status}" } }
3

Thanks @Badger now its working fine :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.