Referencing an Environment Variable when existing field content is part of the name

[Krobar]

Is this possible?

I have tried various configs including the one below:
mutate {
add_field => {
"BRAND_VERSION_NAME" => "BRAND_VERSION_%{Region}_%{Language}"
"BRAND_VERSION" => "'${%{BRAND_VERSION_NAME}}'"
}
}

BRAND_VERSION_NAME does contain the correct environment variable name but the variable name just gets printed for BRAND_VERSION (Rather than the contents of the environment variable)

[Eniqmatic (Lewis Barclay)]

That's because I think you are adding them within the same add_field function, so technically the field does not exist yet when processing. Try splitting it out into a different mutate filter to test first. Also do you need the "$" in the brand_version field name?

[Krobar]

Thank you for the reply. I tried separating out the adds as hown below but the result is still the same:
add_field => {
"BRAND_VERSION_NAME" => "BRAND_VERSION_%{Region}_%{Language}"
}
add_field => {
"BRAND_VERSION" => "'${%{BRAND_VERSION_NAME}}'"
}

Any more ideas on how to fix this?

[Eniqmatic (Lewis Barclay)]

Try them in different mutate filters as above! Also I ask again, did you mean to put the dollar symbol in the field?

mutate {
  add_field => {
    "BRAND_VERSION_NAME" => "BRAND_VERSION_%{Region}_%{Language}"
  }
}
mutate {
  add_field => {
    "BRAND_VERSION" => "'${%{BRAND_VERSION_NAME}}'"
  }
}

[Krobar]

Thanks again but no luck. I think I do want the dollar symbol because I think this needs to be there to refer to the Environment variable.

So for example the fields could be:
Region="cn"
Lanuage="en"

I would be looking to get the content of an environment variable called BRAND_VERSION_cn_en.

[Eniqmatic (Lewis Barclay)]

No to refer to the field it is just %{BRAND_VERSION_NAME}