Mutate filter

Elastic Stack Logstash
1

Can I exchange the field for the existed field?

Like this..

mutate {
	update => {"[matchingCid][0][CID]" => [matchingCid][0][OTC2_CID]}
}

[matchingCid][0][CID] and [matchingCid][0][OTC2_CID] are existed field..

2 
update => {"[matchingCid][0][CID]" => "%{[matchingCid][0][OTC2_CID]}"}
3

Thank you very much! @magnusbaeck

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.