[SOLVED]How to retrive the @value from message?

Elastic Stack Logstash
1

Hi

i want to retrive the value from snmptrap input ,

"message" => "#<SNMP::SNMPv1_Trap:0x4ab319a9 @enterprise=[1.3.6.1.4.1.9.9.187], @timestamp=#<SNMP::TimeTicks:0x6d960737 @value=2612151602>, @varbind_list=[#<SNMP::VarBind:0x7d194c81 @name=[1.3.6.1.4.1.9.9.187.1.2.5.1.17.32.1.14.16.255.255.17.0.0.0.0.0.0.0.0.2], @value="\x00\x00">, #<SNMP::VarBind:0x2fb57cda @name=[1.3.6.1.4.1.9.9.187.1.2.5.1.3.32.1.14.16.255.255.17.0.0.0.0.0.0.0.0.2], @value=#<SNMP::Integer:0x72c769a4 @value=1>>, #<SNMP::VarBind:0x334c21b1 @name=[1.3.6.1.4.1.9.9.187.1.2.5.1.28.32.1.14.16.255.255.17.0.0.0.0.0.0.0.0.2], @value="">, #<SNMP::VarBind:0x4060e1d @name=[1.3.6.1.4.1.9.9.187.1.2.5.1.29.32.1.14.16.255.255.17.0.0.0.0.0.0.0.0.2], @value=#<SNMP::Integer:0xd1e1eb @value=3>>], @specific_trap=7, @source_ip="1.2.3.4", @agent_addr=#<SNMP::IpAddress:0x4992221c @value="\xC0\xA8\v\e">, @generic_trap=6>"

i want to retrive the value @source_ip from message , i try to use
mutate {
add_field => { "source_ip" =>["@source_ip"] }
}
to get the @souce_ip and for the new field , but still can't get the value ,
If anyone knows how to do with it , please help. Thanks.

2

The Mutate filter's add_field uses a different syntax.

mutate {
  add_field => { "source_ip" => "%{@source_ip}" } 
}

Alternatively you could also just rename the field so that you don't have the @source_ip at the end too.

mutate {
  rename => { "@source_ip" => "source_ip" }
}