Logstash mutate filter always stringifies hash and array

Elastic Stack Logstash
1

I have a json log file, which I am taking as a input with this config

input {
   file { filename }
   codec { json_lines }
}

Each line is a deeply nested JSON.

In the filters,

When I say

mutate { add_field => { "new_field_name" => "%{old_field_name}"}
  • if the old_field is a nested hash/array it is converted to a string and then added. Is there anyway I can preserve the type instead of stringifying it ?
2

I suspect it isn't possible with the mutate filter, but you could definitely use a ruby filter:

ruby {
  code => "event['new_field_name'] = event['old_field_name']"
}

(I suspect this makes both fields refer to the same hash so if you modify the hash in another filter you might see both fields getting updated. In that case you have to to make a copy of the hash.)

3

Thanks @magnusbaeck. Will try and update here :smile: