Logstash replace: contatenate string with other field values

Elastic Stack Logstash
1

In the docs there is this replace example:

filter {
mutate {
replace => { "message" => "%{source_host}: My new message" }
}
}

Now I wanna do something like this:

filter {
mutate {
replace => { "autonomous_system.asn" => "as%{autonomous_system_number}" }
}
}

The "as" is a literal string and should form 1 one word with %{autonomous_system_number} (so without a space).

Sample output should be:
"autonomous_system.asn": "as1234"
"autonomous_system.asn": "as5678"

When I try my above example approach, the docs will not be indexed.

2

Depending on your ES release field names can't contain periods. If you want a nested field, i.e.

"autonomous_system": {
  "asn": "as1234"
}

in JSON, use the correct syntax for that ([autonomous_system][asn]).

3

I am using ES5. I changed the config to:
replace => { "[autonomous_system][asn]" => "as%{[autonomous_system][asn]}" }

Now it made the index:
green open %{autonomous_system.asn} lVhCw3IcSOe2JPFV96A2Hw 5 1 18

I'm guessing ES sees the field as literal because there is no space between "as" and the field.

Any suggestions?

4

I'm guessing ES sees the field as literal because there is no space between "as" and the field.

No, that has nothing to do with it.

What does your configuration look like? What does an example event look like? Use a stdout { codec => rubydebug } output.

5

I found out that I was using another wrong JSON nested field syntax in
output{ elasticsearch {index => "%{autonomous_system.asn}" } }

Changed that also to index => "%{[autonomous_system][asn]} and it worked.

So problem solved. Thanks for the help! What should I do with this topic now?

6

What should I do with this topic now?

You don't have to do anything.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.