Mutate filter


#1

Can I exchange the field for the existed field?

Like this..

mutate {
	update => {"[matchingCid][0][CID]" => [matchingCid][0][OTC2_CID]}
}

[matchingCid][0][CID] and [matchingCid][0][OTC2_CID] are existed field..


(Magnus B├Ąck) #2
update => {"[matchingCid][0][CID]" => "%{[matchingCid][0][OTC2_CID]}"}

#3

Thank you very much! @magnusbaeck


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.