logstash add field from third level BUT second level name is dynamic based on another field value
like the bellow example entityType value depending on serviceName value so how should i do it
input {
kafka{
codec => json
bootstrap_servers => "localhost:9092"
topics => ["PO_CREATE_EVENT"]
}
}
filter {
mutate {
add_field => {
"entityType" => "%{[event][%{[serviceName]}][@type]}"
}
add_field => {
"entityId" => "%{[event][productOrder][id]}"
}
add_field => {
"eventName" => "%{[eventType]}"
}
add_field => {
"[auth][requestOrigin]" => "%{[originIp]}"
}
remove_field => ["[auth][authenticationToken]","event","eventType","originIp","@version","@timestamp"]
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["localhost:9200"]
index => "dnext-audit-log-events"
}
}