Metric Filter - Unable to get field references

Elastic Stack Logstash
1

Hello,

I'm using the metrics filter in Logstash to count the number of events triggered per firewall rule.
So, I've got a LS config as below:

if [policyid] {
	metrics {
		add_tag => ["metric"]
		add_field => {"devname" => "%{devname}"}
		meter => "%{devname}_%{policyid}"					
		flush_interval => 5
	}
  }

I get an output as below (snippet)

"XYZ_32" => {
         "rate_1m" => 0.22862424978029233,
        "rate_15m" => 0.11346270423993854,
           "count" => 67,
         "rate_5m" => 0.10272096009080509
 },
 "devname" => "%{devname}",
 "message" => "TESTSYSTEM",
 "tags" => [
    [0] "metric"
]

As can be seen above, "devname" => "%{devname}" doesn't reference properly. However, the metric field is able to pick up the field reference properly "XYZ_32"

Can anyone help me understand why metric filter is unable to reference fields properly?

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.