Logstash Question

[Daniel69]

Hi,

i have a question about logstash:

I'm duplicating a value to easily parse it into an array like this:

mutate {
add_field => ["[@metadata][MESSAGE_DB]", "%{MESSAGE}"]
}

and then i can parse an array number like that:

mutate {
split => { "[@metadata][MESSAGE_DB]" => " " }
add_field => ['DB_INSTANCE','%{[@metadata][MESSAGE_DB][4]}']
}

does its possible to replace de number 4 with a variable NUM_MESSAGE_DB ?

like something like that

add_field => ['DB_INSTANCE','%{[@metadata][MESSAGE_DB][%{[NUM_MESSAGE_DB]}]}']

thanks for your response

[magnusbaeck (Magnus Bäck)]

I don't think you can do that. Why would you want to do that? Maybe there's a better way of parsing your data.

[Daniel69]

NUM_MESSAGE_DB is a value from an yml dictionnary,

so it was a way to dynamicaly get another value...