Remove the values/fields from Logstash

Elastic Stack Logstash
1

Hi,

I want to remove this values %{[@METADATA][HOST][1]} from the field named "FLOOR" . Please see the below Logstash pipeline config.

We have split the fields and then the field name %{[@METADATA][HOST][1]} coming as a value. Please suggest what needs to be done.

mutate
{
add_field => { "[@metadata][host]" => "%{[AP_NAME]}" }
}
mutate
{
split => { "[@metadata][host]" => "-" }
add_field => {
"FLOOR" => "%{[@metadata][host][1]}"
}
}

Regards
Gowtham S

2

If you are saying that the mutate+add_field is adding the literal value "%{[@metadata][host][1]}" when the field [@metadata][host][1] does not exist then that is expected. You can avoid it by testing whether the field exists

mutate { split => { "[@metadata][host]" => "-" } }
if [@metadata][host][1] { mutate { add_field => { "FLOOR" => "%{[@metadata] [host][1]}" } }
3

Thanks for your prompt response will check and update the status

4

PR build got passed once it's approved and merged will let you know the status.