Logstash: Beats input and filters

[Rysiu]

I have a problem.

I have a pipeline in Logstash. I use beats at the entrance.
Beats. Logs are sent by Winlogbeat.

Everything works okay.
But there is a problem.

I want to copy the value of a new field to another field in the filter section.

I tested ruby / mutate and "add_field".

For example:

filter {
    mutate {
        add_field => { "ProcessId" => "%{process.pid}" }
    }
}

There's a field "process.pid" in the documents.
I want to add a field with the same value as "process.pid" but with a name "ProcessId".

Unfortunately, it's not working properly.
Is there any additional consideration for Winlogbeat here?

[Badger]

@Rysiu

"ProcessId" => "%{process.pid}"

If the field name has a period in it then that should work. If the process field is an object that contains a pid field then that should be %{[process][pid]}