Hi !
I do have the following event and I want to add another field and populate this with the content of event_data.IpAddress:
{
"process_id" => 476,
"level" => "Information",
"event_data" => {
"IpAddress" => "172.16.87.87",
"ProcessId" => "0x0"
},
"opcode" => "Info",
"type" => "wineventlog",
"event_id" => 4624
}
In the logstash config I added this to achieve this, but it doesn't work:
...
filter {
mutate {
add_field => { "host" => "%{event_data.IpAddress} }
}
...
It does work if I take for example the event_id:
...
filter {
mutate {
add_field => { "host" => "%{event_id}}
}
...
Any suggestion ?
Kind regards,
Thorsten