Logstash metric not displaying %{count} in the output

Elastic Stack Logstash
1

I have metrics adding 'Counted" tag and sending email when count is greater than 1. All is fine except I receive THREAT count: %{count} 0.20536684761303686 in subject instead of THREAT count: 2 0.20536684761303686

if "Counted" in [tags] {
if [THREAT][count] > 1 {
stdout { codec => rubydebug }
email {
from => "logstash@com.com"
subject => "THREAT count: %{count} %{[THREAT][rate_1m]} "
to => "iromaniuk@com.com"
via => "smtp"
address => "10.10.10.1"

        }
      }
    }

I can see "count" in the output correctly, please advice

{
"@timestamp" => 2017-01-20T21:28:57.895Z,
"@version" => "1",
"message" => "88c14f00ec99",
"THREAT" => {
"rate_1m" => 0.20536684761303686,
"rate_15m" => 0.3826114956412116,
"count" => 2,
"rate_5m" => 0.35006932761717907
},
"tags" => [
[0] "Counted"
]
}

2

I found it , should be %{[THREAT][count]

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.