RabbitMQ input plugin: add_field doesn't write @metadata

Elastic Stack Logstash
1

This is using logstash 5.2.0 and the version of the RabbitMQ plugin that comes with it.

input {
  rabbitmq {
    ...
    add_field => {
      "[@metadata][indexType]" => "myindex"
    }
}

output {
  elasticsearch {
    hosts => ["elasticsearch"]
    index => "%{[@metadata][indexType]}-%{+YYYY.MM.dd}"
  }
}

Results in errors due to [@metadata][indexType] not being set. But this workaround does work:

input {
  rabbitmq {
    ...
    add_field => {
      "indexType" => "myindex"
    }
}

filter {
  mutate {
    add_field => { "[@metadata][indexType]" => "%{indexType}" }
    remove_field => [ "indexType" ]
  }
}

...

Googling suggested to me that the prior syntax is expected to work, at least for the file plugin. Is this a bug?

2

Don't you have => after add_field in your input block?

3

No, I do, that's a copy/paste error on my part. I've edited the question.

4

I can confirm that this is a bug (a regression introduced in v5.0.0 of the plugin). I've filed this issue:

1 Like
5

Excellent, thank you for the quick turnaround. Looking forward to this being fixed - I'll watch the GitHub issue.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.