Logstash clone filter use event field as clones parameter

[ebourlon]

Hello,

I made some tests with the clone filter in logstash. In my opinion there is no way to make the "clones" parameter dynamic.
Does someone know how this can be done? Looking at the filter code I think it might be considered as an enhancement of this plugin.

Br,

input {
  stdin{
    id => "mystdin"
	ecs_compatibility => disabled
	add_field => {"clones_array" => ["clone1","clone2"]}
  }	
}
'''
filter {
	clone {
	  clones => "%{[clones_array]}"
	  #clones => clones_array
	  #clones => [clones_array]
	  ecs_compatibility => disabled
	}
}
output {
  stdout {
    codec => json
  }
}

The clones parameter is taken as-is, giving as result:

{"clones_array":["clone1","clone2"],"message":"Hello\r","host":"ms-prd-eaiwe-02","@version":"1","@timestamp":"2021-06-08T07:28:53.065Z"}
{"clones_array":["clone1","clone2"],"message":"Hello\r","host":"ms-prd-eaiwe-02","type":"%{[clones_array]}","@version":"1","@timestamp":"2021-06-08T07:28:53.065Z"}

[Badger]

Correct, the value of the clones option is a literal, the clone filter does not sprintf it.