Hi,
is there a way to move all @metadata fields at once so i can preserve it over multiple logstash instances until it gets to ES?
Maybe something like a recursive
mutate { rename => { "@metadata" => "meta" } }
because when I do it this way, i only get "meta" : null
Thanks
Are you certain @metadata
exists?
With a bare-bones config there is no @metadata created.
input {
generator { message => "a message" count => 1 }
}
# filter {
# mutate {
# copy => { "@metadata" => "metacopy" }
# rename => { "@metadata" => "meta" }
# }
# }
output {
stdout { codec => rubydebug {metadata => true } }
}
Gives
{
"sequence" => 0,
"@timestamp" => 2019-04-04T10:02:43.286Z,
"host" => "Elastics-MacBook-Pro.local",
"@version" => "1",
"message" => "a message"
}
Maybe mutate/copy
is closer to your intended use case.
input {
generator {
message => "a message"
count => 1
add_field => {"[@metadata][foo]" => "bar"}
}
}
filter {
mutate {
copy => { "@metadata" => "metacopy" }
}
}
output {
stdout { codec => rubydebug {metadata => true } }
}
Gives:
{
"sequence" => 0,
"@timestamp" => 2019-04-04T10:06:17.556Z,
"@metadata" => {
"foo" => "bar"
},
"metacopy" => {
"foo" => "bar"
},
"@version" => "1",
"host" => "Elastics-MacBook-Pro.local",
"message" => "a message"
}
The rename (and copy) are "recursive" as rename one change the key name that is pointing to a hash of values and copy should create a new key with a clone of the value to be copied.
Yes I did have @metadata fields from a filebeat, I also confirmed it with a debug output.
Currently I copy it field by field, i will try it later if its working with copy to move all @metadata fields at once.
Thanks so far
Badger
April 4, 2019, 11:42am
4
You cannot rename [@metadata ] due to this issue.
system
(system)
Closed
May 2, 2019, 11:42am
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.