I have used add_filed, remove_field, rename etc.. many time over on logstash
now I have something different that I can't quite figure out.
runnign nvidiabeat and it gives me following
{
"clocks":{"mem":405,"sm":139,"gr":139},
"memory":{"used":623,"total":11172},
"utilization":{"gpu":0,"memory":0},
"pstate":8,
"power":{"limit":135,"draw":16.38},
"driver_version":384.9,
"fan":{"speed":23},
"type":"nvidiagpubeat",
"count":4,
"name":"GeForceGTX1080Ti",
"temperature":{"gpu":30}
}
I want to move whole thing under
"system": {
"gpu": {
"clocks":{"mem":405,"sm":139,"gr":139},
"memory":{"used":623,"total":11172},
"utilization":{"gpu":0,"memory":0},
"pstate":8,
"power":{"limit":135,"draw":16.38},
"driver_version":384.9,
"fan":{"speed":23},
"type":"nvidiagpubeat",
"count":4,
"name":"GeForceGTX1080Ti",
"temperature":{"gpu":30}
}
}
I have try this as test but didn't work
if [utilization][gpu] {
mutate { add_field => {"[system][gpu][utilization][gpu]" => "%{[utilization][gpu]}" }
}
}