I need add field, and do value counter, how do it?

[Tomo_M (Tomohiro Mitani)]

You need to hold state in Logstash, but it is not explicitly supported.

How to hold a state in Logstash?

Hi, I'm trying to apply a state (with a field in ES) to subsequent log lines after seeing [message] =~ "foo" but have not had luck using class variables with the ruby filter (@@classVariable) as described in Keeping global variables in LS?! with logstash 6.0.1. I find that the class variable does not hold the correct value when exploring the data on discover in Kibana. Specifically, I want the state to change when I see [message] =~ "bar" and then hold that value until [message] =~ "foo" is …

What is your purpose of using such incremental ids? Elasticsearch default _id is not enough?