Reference "numbered" fields in sprintf format

I want to read the following json object in logstash.

"aggregations": {
"_percentile": {
"values": {
"5.0": 10,
"95.0": 10
}

The following doesn't work:

mutate {
add_field => { "target" => "%{[aggregations][_percentile][values][5.0]}" }
}

exception:

"reason"=>"Field name [5.0] cannot contain '.'"

Neither the following:

mutate {
add_field => { "target" => "%{[aggregations][_percentile][values]['5.0']}" }
}

No exception but target doesn't get the value

"target":"%{[aggregations][_percentile][values]['5.0']}

Is there a different syntax to read "number" fields? Technically, the field names are quoted. They are valid json syntax and should be treated as strings. Not sure why logstash sprintf format is not able to handle this.

I used the following ruby filter wokaround. But it would be nice if mutate filter doesn't have so many surprises.

  ruby{
    code => "
      event['target'] = event['aggregations']['_percentile']['values']['5.0'];
    "
  }

Please raise an issue against the plugin so we can take a closer look :slight_smile:

as you wish :slight_smile:

1 Like