Hey,
I realized that the following line :
remove_field => [ "[doc][vegetables][%{[tmp_vegetable_data][name]}]" ]
Was not only removing [doc][vegetables][%{[tmp_vegetable_data][name]}]
, but was also like removing [tmp_vegetable_data][name]
. Note that if you use stdout { codec => rubydebug}
, you will still be able to see the [tmp_vegetable_data][name]
field content, like if it was still there, but, in reality, you cannot use the [tmp_vegetable_data][name]
field content anymore (it's like empty in reality, even if the rubydebug codec is showing it as still available/present).
I don't think it is an expected behaviour.
(logstash 7.14.0)
Have a good day !