Hello, I would like to change the tags field to a lowercase field.
My original message like this:
{ "@timestamp": "2019-08-08T13:33:38.86", "appid": "bla", "tags": [ "SUCC:AUTHEN"] }
My filter:
mutate {
rename => { "[tags]" => "[tags_tmp]" }
}
if "SUCC" in [tags_tmp] {
add_tag = ["succ"]
}
OR
if [tags_tmp] =~ /SUCC/ {
add_tag = ["succ"]
}
My result:
"tags_tmp": ["SUCC:AUTHEN"],
"tags": ,
Why the tags field is empty??