Mutate - add_field - only shows string not the value

Elastic Stack Logstash
1

Hi,

I am using Windows 10 with 7.17.6 on localhost install. Filebeat is input being sent to Logstash.

Yes, I know the json parser will handle this for me. But I do not understand why "someNewField"
does not have the value? -- Thank you

"someNewField" => "%{[message][paymentType]}",

This is my input:

{"id":11,"timestamp":"2019-08-03T19:37:51Z","paymentType":"Mastercard"}

This is my logstash conf:

input {
  beats {
    port => 5044
  }
}

 filter {
		   json { 
	        source => "message"
	    }
	    mutate {
		    add_field => { 
			    "someNewField" => "%{[message][paymentType]}"
		    }
	    }
    }

	
output {
 stdout {  }
}

This is my output (i removed irrelevant lines):

{
             "log" => {
          "file" => {
            "path" => "C:\\filebeat-7.17.6-windows-x86_64\\datainputs\\sample-json.log"
        },
    "someNewField" => "%{[message][paymentType]}",
      "@timestamp" => 2023-06-24T15:23:40.505Z,
           "input" => {
        "type" => "log"
    },
              "id" => 12,
        "@version" => "1",
     "paymentType" => "Mastercard",
         "message" => "{\"id\":12,\"timestamp\":\"2019-08-03T19:37:51Z\",\"paymentType\":\"Mastercard\"}",
       "timestamp" => "2019-08-03T19:37:51Z",
}
2

Because there is no paymentType field nested under a message field.

Your message field looks like this:

{"id":11,"timestamp":"2019-08-03T19:37:51Z","paymentType":"Mastercard"}

When you parse it using the json filter the field paymentType will be created at the root of your document.

So, you need to use only %{paymenteType} in your mutate, not [message][paymentType].

3

Well you are remarkable. That works!!
I was trying to work with the RHS (right hand side) with %{paymenteType} [message][paymentType], and %{[message][paymentType]}, and "%{[message][paymentType]}" with other things I have been working on.

I get confused when any of those RHS syntaxes work and dont work.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.