Is it possible to interpolate a field's value in a string?

Hi there, I've been messing with Filebeat for about 2 days now..
I can't find a way to interpolate a field in another field. Here's what I have:

    processors:
      - add_fields:
          target: ""
          fields.mysubtype: "ABC"
      - add_fields:
          target: ""
          fields.type: "abc-%{mysubtype}"

Expecting my output to be:

    {
      "type": "abc-ABC"
    }

but the output is not interpolated, so the result remains:

    {
      "type": "abc-%{mysubtype}"
    }

I even tried with square brackets, i.e. "%{[mysubtype]}". This is on Filebeats v 7.11.2
Any suggestions, ideas, pointers? :slight_smile: Thank you!

Ok, I found a solution. By using the script processor, I quickly achieved what I wanted. Seems weird that fields are not reference-able from any processor (i.e. in Logstash the format above works). Anyway, here's what I did:

- script:
    lang: javascript
    source: >
      function process(event) {
          event.Put("type", "abc-" + event.Get("mysubtype"));
      }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.