Logstash Syntax :: Copy String from One Field into a New Field

[redapplesonly (RAO)]

Hello Logstash Zen Masters,

In my data, I have a field named FieldA which contains a string. Later in my filter{} section, I need to access and copy that string into a newly-created field. I've tried a lot of variations which allow Logstash to launch, but cause a Java error shortly after LS gets going.

I need this:

if SOME_CONDITION {
  mutate {
    add_field => { "NewField" => %[FieldA] }
  }
}

...or even...

if SOME_CONDITION {
  mutate {
    add_field => { "NewField" => "blahblah" }
    copy => { "FieldA" => "NewField" }
  }
}

Whatever works. Any suggestions?

BTW, the Java error message is really long and scary and far too large to post here in its entirity. I see Null Pointer Exceptions and Illegal State Exceptions and worse. I'm fairly confident that FieldA is not NULL... but perhaps the error means I got the syntax right and FieldA is not being set correctly? Asking for a friend...

[2020-06-18T10:56:39,229][FATAL][logstash.runner          ] An unexpected error occurred! {:error=>java.lang.IllegalStateException: java.lang.NullPointerException, :backtrace=>["org.logstash.execution.WorkerLoop.run(org/logstash/execution/WorkerLoop.java:105)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke(jdk/internal/reflect/NativeMethodAccessorImpl.java:62)", "jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(jdk/internal/reflect/DelegatingMethodAccessorImpl.java:43)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:566)", "org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:441)", "org.jruby.javasupport.JavaMethod.invokeDirect(org/jruby/javasupport/JavaMethod.java:305)", "home.me.logstash.logstash_minus_7_dot_7_dot_1.logstash_minus_core.lib.logstash.java_pipeline.start_workers(/home/me/logstash/logstash-7.7.1/logstash-core/lib/logstash/java_pipeline.rb:279)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:318)", "java.lang.Thread.run(java/lang/Thread.java:834)"]}
[2020-06-18T10:56:39,248][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

[Badger]

@redapplesonly

add_field => { "NewField" => %[FieldA] }

That should be

add_field => { "NewField" => "%{[FieldA]}" }

[redapplesonly (RAO)]

THanks Badger,

Still getting the scary Java error, though, so now I need to investigate why that is. Perhaps FieldA is null...? I'll have to dig deeper.

 THanks!  -ROA