Logstash mutate nested dynamic field path

logstash add field from third level BUT second level name is dynamic based on another field value
like the bellow example entityType value depending on serviceName value so how should i do it

input {
  kafka{
    codec => json
    bootstrap_servers => "localhost:9092"
    topics => ["PO_CREATE_EVENT"]
  }
}

filter {
mutate {
	 

	 add_field => {
        "entityType" => "%{[event][%{[serviceName]}][@type]}"
      }
	 add_field => {
		"entityId" => "%{[event][productOrder][id]}"
	  }
	  add_field => {
        "eventName" => "%{[eventType]}"
      }
	  add_field => {
        "[auth][requestOrigin]" => "%{[originIp]}"
      }
	  
      remove_field => ["[auth][authenticationToken]","event","eventType","originIp","@version","@timestamp"]
    } 

}

output {
  stdout { codec => rubydebug } 
  elasticsearch {
      hosts => ["localhost:9200"]
      index => "dnext-audit-log-events"
  }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.