Json target based field value (or tag)?


I'd like to dynamically set the json target based on a field value. I tried:

target => "%{field}"

with no success. Is there an easy way to accomplish this?

I assume you are talking about the json filter? If so the current implementation of the plugin doesn't support using field reference, the "%{field}" syntax, as the target to the decoded string.

I suggest you create an issue on the plugin repository on github



I tried the below in the filter , I don't know weather it is right or wrong but itz perfectly worked for me.

filter {
	source => "json_message"
	target => "dynamic_json_field"
  mutate {
    rename => { "dynamic_json_field" => "%{type}" }