Recreate new field from old field

I have used add_filed, remove_field, rename etc.. many time over on logstash

now I have something different that I can't quite figure out.

runnign nvidiabeat and it gives me following

{
        "clocks":{"mem":405,"sm":139,"gr":139},
        "memory":{"used":623,"total":11172},
         "utilization":{"gpu":0,"memory":0},
        "pstate":8,
        "power":{"limit":135,"draw":16.38},
        "driver_version":384.9,
        "fan":{"speed":23},
        "type":"nvidiagpubeat",
        "count":4,
        "name":"GeForceGTX1080Ti",
        "temperature":{"gpu":30}
 }

I want to move whole thing under

"system": {
    "gpu": {
             "clocks":{"mem":405,"sm":139,"gr":139},
            "memory":{"used":623,"total":11172},
             "utilization":{"gpu":0,"memory":0},
            "pstate":8,
            "power":{"limit":135,"draw":16.38},
            "driver_version":384.9,
            "fan":{"speed":23},
            "type":"nvidiagpubeat",
            "count":4,
            "name":"GeForceGTX1080Ti",
            "temperature":{"gpu":30}
   }
}

I have try this as test but didn't work

 if [utilization][gpu]  {
        mutate { add_field => {"[system][gpu][utilization][gpu]" => "%{[utilization][gpu]}"  }
     }
  }

well it is working now.
I had this inside some other loop and hence it was not even picking up.

consider it as solved.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.