Referencing fields in Metrics output

Elastic Stack Logstash
1

Hi,
I'm trying to output a custom formatted line which must include:

  1. Events per second metric.
  2. The LS hostname.

I have this metric filter in the "filter" section:

metrics {
    meter => "events"
    add_tag => "metric"
    flush_interval => 5
}

And I have this block in my output section:

if "metric" in [tags] {
        stdout {
            codec => line {
                format => "%{host}  1m event rate: %{[events][rate_1m]}"
            }
        }
    }

But for some reason the %{host} value is not being output and I am getting the literal string '%{host}' ouput to the console like this:

%{host} 1m event rate: 0.0

What am I doing wrong? Can we not use %{field_name} in the metrics output? I need to output a specifically formatted line for the metrics to be collected properly with my application.

Would appreciate any advice on why my fields don't appear to be available to me.

Thanks!

2

The symptoms indicate that the metrics event don't have a host field. Looking at the source it looks like it's the message field the includes the hostname. Not sure why it's done like that.

3

Thanks @magnusbaeck

That's a bit of a disappointment, to say the least. Any ideas about how to get the Logstash hostname or other unique identifier into the metrics output? We are planning on having a cluster of LS machines and it is essential to know what kind of throughput each machine is dealing with... Would be grateful for any suggestions.

4

You can do what I did , add a flag to logstash --allow-env its a new feature

https://www.elastic.co/guide/en/logstash/current/environment-variables.html

Then it would be as easy as
----------------sudo code-----
mutate {
add_field => ["host" , "${HOSTNAME}"
}

5

Any ideas about how to get the Logstash hostname or other unique identifier into the metrics output?

So... the hostname isn't present in the message field?

6

@magnusbaeck
Thanks for your input. Yes the message field does indeed contain the hostname and I was able to leverage that to generate the structure/formatting I needed. Many thanks! I do have another question about metrics but I'll create a new thread for that.

@eperry
Thanks for the suggestion. Much appreciated

7

I'm also experiencing the same issue, I have a 'response' field in my message, which I can use to generate a metric, but am not able to use this field to add a new field to the metric event.

Did you ever solve this?