Logstash Mutate Filter

Elastic Stack Logstash
1

Hello

I am using Logstash version 7.8.0 in our environment.

I am using logstash to extract data from JDBC database using input - jdbc and output == Elasticsearch v7.8.0

doing so , in between I am using filter - mutate as follows ...

filter {
  mutate {
    copy => { "[object_id][last_updated_date]" => "[@metadata][_id]"}
  }
}

In here , my JDBC , has two fields object_id and last_updated_date making an record as unique in entire table.

Hence i would like to pass same to _id in Elasticsearch.

But Its not working as expected. This mine above SYNTAX is failing.

Could someone please help me to how to put two columns data into _id .

Thank You.

2

Use

mutate { add_field => { "[@metadata][_id]" => "%{[object_id]}-%{[last_updated_date]}" } }

Using the - to separate the two fields is optional.

3

Yes , this worked 100%, Thank You ..

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.