Replace field value by part of output message

I want to replace level filed value by output message "levelName" 's value. Is it possible to do this in logstash conf?

filter {
	if [fields][level] == "default" {
		grok {
      match => {"message" => ["(?m)%{TIMESTAMP_ISO8601:timestamp}\|%{NOTSPACE:orgCode}\|%{NOTSPACE:traceId}\|%{WORD:levelName}\|%{NOTSPACE:logger}\|%{GREEDYDATA:message}"]}
	mutate {
	lowercase => ["level"]
	replace => [ "level", %{level} ]

above conf is invalid according to logstash

What error message do you get?

That sets the field [level] to the value of the field [level], so it is a no-op. Did you mean to use this?...

replace => { "level" => "%{levelName}" }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.