Logstash add_field issue

I am aware you can replace a field but I need to copy the content from the field agent._id to a new field called AgentIdentifier for testing purposes .

mutate {

add_field => {"AgentIdentifier", "%{[fields][agent._id]}"}

What am i doing wrong here ?

[fields][agent._id] refers to a field with a dot in its name inside the [fields] object. My guess is you want the field called _id inside the agent object, which would be [agent][id]. Not sure whether you really want [fields] or not.

1 Like

So use %{[agent][id]}

1 Like

ohh, thats what you meant . i had syntax wrong

Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.