Logstash clone filter use event field as clones parameter

Elastic Stack Logstash
1

Hello,

I made some tests with the clone filter in logstash. In my opinion there is no way to make the "clones" parameter dynamic.
Does someone know how this can be done? Looking at the filter code I think it might be considered as an enhancement of this plugin.

Br,

input {
  stdin{
    id => "mystdin"
	ecs_compatibility => disabled
	add_field => {"clones_array" => ["clone1","clone2"]}
  }	
}
'''
filter {
	clone {
	  clones => "%{[clones_array]}"
	  #clones => clones_array
	  #clones => [clones_array]
	  ecs_compatibility => disabled
	}
}
output {
  stdout {
    codec => json
  }
}

The clones parameter is taken as-is, giving as result:

{"clones_array":["clone1","clone2"],"message":"Hello\r","host":"ms-prd-eaiwe-02","@version":"1","@timestamp":"2021-06-08T07:28:53.065Z"}
{"clones_array":["clone1","clone2"],"message":"Hello\r","host":"ms-prd-eaiwe-02","type":"%{[clones_array]}","@version":"1","@timestamp":"2021-06-08T07:28:53.065Z"}
2

Correct, the value of the clones option is a literal, the clone filter does not sprintf it.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.