# LS5.3: Variable codec setting

**URL:** <https://discuss.elastic.co/t/ls5-3-variable-codec-setting/108986>\
**Category:** Logstash\
**Created:** [November 24, 2017, 8:03am UTC](https://discuss.elastic.co/t/ls5-3-variable-codec-setting/108986 "2017-11-24T08:03:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![AlexW](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@AlexW](https://discuss.elastic.co/u/AlexW)\
**Post date:** [November 24, 2017, 8:03am UTC](https://discuss.elastic.co/t/ls5-3-variable-codec-setting/108986/1 "2017-11-24T08:03:59Z")

</div>

Hi!  
I wanted to optimize my Logstash config. The old one looked like this:

```
output {
  if ("json_extracted" in [tags]) {
    elasticsearch {
      codec => "json"
      hosts => <%= $es_hosts.prefix('"').suffix('"') %>
      index => '%{elk_input}-%{+YYYY.MM.dd}'
    }
  } else {
      elasticsearch {
        codec => "plain"
        hosts => <%= $es_hosts.prefix('"').suffix('"') %>
        index => '%{elk_input}-%{+YYYY.MM.dd}'
      }
  }
...
}

```

This pattern is repeated multiple times. You can see the only difference is the codec setting (json vs. plain). I thought I could use a variable for that, but did not find a way how to set one. Luckily I found the @metadata field. So I changed my code to this:

```
filter {
  if ("json_extracted" in [tags]) {
    mutate { add_field => { "[@metadata][codec]" => "json" } }
  } else {
    mutate { add_field => { "[@metadata][codec]" => "plain" } }
  }
}
output {
  elasticsearch {
    codec => "%{[@metadata][codec]}"
    hosts => <%= $es_hosts.prefix('"').suffix('"') %>
    index => '%{elk_input}-%{+YYYY.MM.dd}'
  }
...
}

```

What it should do is decide if json or plain is used, store that in @metadata.codec and use it in the output on field codec.  
Well, that doesn't work. Is the idea totally wrong or did I do a syntax error which I have missed?

Thanks for your help,  
Alex

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 24, 2017, 8:18am UTC](https://discuss.elastic.co/t/ls5-3-variable-codec-setting/108986/2 "2017-11-24T08:18:44Z")

</div>

There's never a need to modify the `codec` option of the elasticsearch output. Just leave it alone and things will work fine.

---

<div class="post-metadata">

**Author:** ![AlexW](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@AlexW](https://discuss.elastic.co/u/AlexW)\
**Post date:** [November 24, 2017, 9:03am UTC](https://discuss.elastic.co/t/ls5-3-variable-codec-setting/108986/3 "2017-11-24T09:03:13Z")

</div>

Thanks! I thought I need to set it to json if I want to write messages in json. Good to know that this is not true. I will remove it.

Nevertheless I would like to know if there are variables which I can set and get in Logstash config. It seems that not every setting supports the %{} syntax. Is that correct?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 24, 2017, 9:08am UTC](https://discuss.elastic.co/t/ls5-3-variable-codec-setting/108986/4 "2017-11-24T09:08:23Z")

</div>

> Nevertheless I would like to know if there are variables which I can set and get in Logstash config.

You already know about the `@metadata` field and the rest of your configuration should work, it's just that the use of `codec` doesn't make any sense (plus the `codec` option probably don't support that kind of string interpolation).

> It seems that not every setting supports the %{} syntax. Is that correct?

That's correct. Unfortunately it's not documented where it's supported and where it isn't.

---

<div class="post-metadata">

**Author:** ![AlexW](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@AlexW](https://discuss.elastic.co/u/AlexW)\
**Post date:** [November 24, 2017, 9:09am UTC](https://discuss.elastic.co/t/ls5-3-variable-codec-setting/108986/5 "2017-11-24T09:09:27Z")

</div>

Perfect! Thanks for your answer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 22, 2017, 9:09am UTC](https://discuss.elastic.co/t/ls5-3-variable-codec-setting/108986/6 "2017-12-22T09:09:32Z")

</div>

Closed on December 22, 2017, 9:09am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.