Logstash aggregation filter configuration

(Grycuk) #1

Hi there

I'm hoping someone can help me with this please. If I have an input file in json format with a field named uuid that I wish to use as a task id in the logstash aggregate plugin. What is the correct syntax to use to specify this?

Should it be task_id => "uuid" or task_id=>event['uuid'] or something else. I can't get it to work at present and any help would be appreciated.

Paul G

(Magnus B├Ąck) #2
task_id => "%{task_id}"

Documented here: https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#sprintf

(Grycuk) #3

Thanks very much!

(system) #4