Logstash Question



i have a question about logstash:

I'm duplicating a value to easily parse it into an array like this:

mutate {
add_field => ["[@metadata][MESSAGE_DB]", "%{MESSAGE}"]

and then i can parse an array number like that:

mutate {
split => { "[@metadata][MESSAGE_DB]" => " " }
add_field => ['DB_INSTANCE','%{[@metadata][MESSAGE_DB][4]}']

does its possible to replace de number 4 with a variable NUM_MESSAGE_DB ?

like something like that

add_field => ['DB_INSTANCE','%{[@metadata][MESSAGE_DB][%{[NUM_MESSAGE_DB]}]}']

thanks for your response

(Magnus B├Ąck) #2

I don't think you can do that. Why would you want to do that? Maybe there's a better way of parsing your data.


NUM_MESSAGE_DB is a value from an yml dictionnary,

so it was a way to dynamicaly get another value...

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.