Problem when adding fields to logstash

Elastic Stack Logstash
2

What is the correct config you are using? On the first one your add_field is wrong, you are passing an array instead of a hash, but in your second config that you pasted it is right, you are passing a hash.

The correct format for add_field is this:

mutate {
    add_field => { "received_at" => "%{@timestamp}" }
}

Not this:

mutate {
    add_field => [ "received_at", "%{@timestamp}" ]
}

Which one are you using?

Can you share an example of the output of an event?

1 Like