Logstash add_field issue

[Elk_huh (Brian)]

I am aware you can replace a field but I need to copy the content from the field agent._id to a new field called AgentIdentifier for testing purposes .

mutate {

add_field => {"AgentIdentifier", "%{[fields][agent._id]}"}
}

What am i doing wrong here ?

[Badger]

[fields][agent._id] refers to a field with a dot in its name inside the [fields] object. My guess is you want the field called _id inside the agent object, which would be [agent][id]. Not sure whether you really want [fields] or not.

[Badger]

So use %{[agent][id]}

[Elk_huh (Brian)]

@Elk_huh

add_field => {"AgentIdentifier", "%{[fields][agent._id]}"}

ohh, thats what you meant . i had syntax wrong

Thank you!