Mutate -> Copy is not working as expected

Elastic Stack Logstash
1

Im working on some json data, transforming and remapping fields
add_field, rename plugins are working as expected

But whenever im using copy, output does not include these [events][date], [env][app] fields. But does include [env][date]. That means field is not empty and format is proper i assume?
Also tried with an alternative, using add_field to produce target fields as empty to see if copy failing to create field in first place or not.

filter {
if [log][file][path] =~ "/var/log/trace/*" {
    mutate {
        copy => {
        "[type1][timestamp]" => "[events][date]"
        "[type1][tags][http.path]" => "[env][app]"
        }
        rename => {
        "[type1][timestamp]" => "[env][date]"
        }
        remove_field => ["^type1\."]
    }
  }
}

Updated to latest 8.x.x to test, same happens again

3

A mutate filter processes options in a fixed order. rename is processed before copy. [type1][timestamp] will no longer exist when the filter tries to copy it, so it does not get copied. Use two mutate filters.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.