Is it possible to do nested calls of event fields?

[aidanoc15]

I'm not sure if I am really phrasing the issue I am having correctly, so let me show you an example of what I am trying to do and maybe you can tell me if this is possible in logstash.

add_field => { "[variables][companyIdentifier]" => "%{[cw_auth][hits][hits][0][_source][connectwise][company_ids][%{client}][id]}" }

As you can see, I am trying to pass in the value of one event field as part of the key for another event field. This is currently not working and [variables][companyIdentifier] just becomes the string "%{[cw_auth][hits][hits][0][_source][connectwise][company_ids][%{client}][id]}."

My suspicion is that this most likely is not directly possible, but I was wondering if there might be some work around involving a ruby code or something that could accomplish this?

Any help is appreciated, thanks in advance.

[Badger]

@aidanoc15

I was wondering if there might be some work around involving a ruby code

The following is not tested, but should give you an idea:

code => '
    clientid = event.get("client")
    ids = event.get("[cw_auth][hits][hits][0][_source][connectwise][company_ids]")
    event.set("[variables][companyIdentifier]", ids[#{client}]["id"]}
'