Can logstash nest fields more than two levels?
I wanted to use [http][response][content-length],
but the output field becomes [response][content-length] when I do that in a grok filter.
Can logstash nest fields more than two levels?
Yes, that shouldn't be a problem.
I wanted to use [http][response][content-length],
but the output field becomes [response][content-length] when I do that in a grok filter.
Please give a complete example and state what version of Logstash you have.
I'm using logstash 2.0.0.
I spent some time trying to strip down my config to something smaller and could not reproduce the problem.
I scrolled back in my terminal, and I see that the "http" was there and the stdout output filter formatting confused me into thinking the http was missing.
Thanks for your reply, and I apologize for not double-checking myself before posting.