Metrics plugin -> how to copy fields from source event?

Elastic Stack Logstash
1

Hi there,

I have a logfile for which I would like to have a metric.
Each log event is also having a field named "Stage" which identifies if the event comes from dev, qa or production.

Here comes my filter code (i removed the uninteresting part for my problem)

filter
{
    if [type] == 'mylog' or [LogFile] == 'mylog'
    {
        # .. do the grok parsing
        }
        
        
        
        mutate
        {
            # .. do some type conversions
        }
        
        # parse date
        date 
        {
            # .. parse the date
        }
            # setting up the metrics
        
        metrics 
        {
            # create a meter based on the extracted service / subservice
            meter => [ "%{servicename}_%{Stage}" ]
            
            # set up how often a metrics event should be created
            flush_interval => 60
            
            ignore_older_than => 60
            
            # mark the metric event with a tag
            add_tag => "myMetric_%{Stage}"  
            add_field => { "Stage" => "%{Stage}" }
        }
    }
}

The "servicename" is a field which is parsed by grok inside the filter.
The "Stage" field is already added in nxlog which we are using for shipping logs as json field. So it is not parsed by grok, but it is already available in all source events.

Now my problem:
The metric event is not resolving the stage variable correctly. It is giving me the following:

 "tags": [
      "myMetric_%{Stage}"
    ]
..
"Stage1": "%{Stage}",

Adding dynamic field values should be possible as I understand the documentation.

Thanks, Andreas

2

Please show the whole event. The myMetric_%{Stage} tag indicates that your event doesn't actually have a Stage field.