Logstash metrics for different types?

Elastic Stack Logstash
1

I'd like to use the metrics filter to give me output of metrics for various type data that is coming in. How would I do that?

For example, if Logstash is reading in, and the type can be "http", "dns", or "dhcp", I'd like to be able to run the metrics plugin to get a count of each of those types of events.

How can I set up the meter so that I can get stats per type?

Something like

filter {
    if [type] == "generated" {
        metrics {
             meter => [ "events", "type.%{log_type}" ]
             add_tag => "metric"
        }
    }
}
output {
    if "metric" in [tags] {
        file {
            path => "/path/to/output.log"
            codec => line {
                format => "rate(event) - count:%{[events.http][count]}  count:%{[events.dns][count]}"
            }
        }
    }
}
2

That looks ok, have you tested it?

3

No. It doesn't work. The output simply says rate(event) - count:%{events.http][count] ...