# String interpolation failing in event dependent config **URL:** \ **Category:** Logstash\ **Created:** [May 23, 2016, 8:40pm UTC](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768 "2016-05-23T20:40:43Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![joshzitting](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@joshzitting](https://discuss.elastic.co/u/joshzitting)\ **Post date:** [May 23, 2016, 8:40pm UTC](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768/1 "2016-05-23T20:40:43Z")
I am attempting to use a dynamic/event dependent config (as shown here [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)) however I keep getting an errror. I am trying to output data to sentry depending on the severity, and the type of log that it is processing. This is what the output section looks like ```auto sentry { host => '192.168.1.101' key => 'b3921923d34c4344878g7a83e2061229' secret => 'd0163as306c04148aee49fe4ae7621b1' project_id => '2' msg => "[@metadata][sentry][id]" level_tag => "[sentry]" (have also tried "%{sentry}", %{sentry}, "[@metadata][sentry][severity]" ) etc. #level_tag => "fatal" } ``` And this is what my filter looks like.. ```auto filter { if [type] == "syslog" { mutate { add_field => {"[@metadata][sentry][id]" => "%{host}"} # add_field => { "[sentry_severity]" => "%{severity}" } add_field => {"sentry" => "fatal"} # add_field => {"[@metadata][sentry][severity]" => "fatal" } } } } ``` This is what sentry is receiving.. ```auto { "name": "level", "value": "[sentry]" } ``` the part I am having an issue with is 'level\_tag =\> "[sentry]" ' (as you can see I have tried a handful of variables without success) I would prefer to use a metadata one.. I have tried every type of interpolation there that I can find and no matter what it keeps passing in the variable name as opposed to the data contained in the variable.. however when I do a std out it DOES show that the variable IS set to the right string. Any help is sooooo appreciated.. What I would hope to do is be able to have host, key, secret, project\_id, level tag, all variables that are set in the filters section... Thanks! Josh ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 24, 2016, 6:11am UTC](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768/2 "2016-05-24T06:11:40Z")
> msg =\> "[@metadata][sentry][id]" Should be: ``` msg => "%{[@metadata][sentry][id]}" ``` > level\_tag =\> "[sentry]" Should be (square brackets optional): ``` level_tag => "%{[sentry]}" ``` Please show an example event as presented by a `stdout { codec => rubydebug }` codec so we can see exactly what the events look like. ---
**Author:** ![joshzitting](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@joshzitting](https://discuss.elastic.co/u/joshzitting)\ **Post date:** [May 24, 2016, 6:02pm UTC](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768/3 "2016-05-24T18:02:15Z")
> [@magnusbaeck](#): > > "%{[@metadata][sentry][id]}" Here is the debug output.. ```auto { "message" => "pam_unix(cron:session): session closed for user root\n", "@version" => "1", "@timestamp" => "2016-05-24T17:17:01.000Z", "type" => "syslog", "host" => "10.129.21.17", "priority" => 86, "timestamp" => "May 24 17:17:01", "logsource" => "d27ca252-44d5-45e1-e7e1-d3f3a0212799", "program" => "CRON", "pid" => "7806", "severity" => 6, "facility" => 10, "facility_label" => "security/authorization", "severity_label" => "Informational", "sentry" => "fatal", "@metadata" => { "sentry" => { "id" => "10.129.21.17" } } } ``` also ```auto { "message" => "pam_unix(cron:session): session closed for user root\n", "@version" => "1", "@timestamp" => "2016-05-23T22:17:01.000Z", "type" => "syslog", "host" => "10.129.21.17", "priority" => 86, "timestamp" => "May 23 22:17:01", "logsource" => "d27ca252-44d5-45e1-e7e1-d3f3a0212799", "program" => "CRON", "pid" => "7569", "severity" => 6, "facility" => 10, "facility_label" => "security/authorization", "severity_label" => "Informational", "sentry" => "fatal", "@metadata" => { "sentry" => { "id" => "10.129.21.17" } } } ``` As you can see the feild "sentry" is set to fatal.. However with the config set as you suggested above.. Here is the json event data that sentry received.. ```auto {"id":"017a8bb3fb9d42f8be8bf51d6a6241f5","project":2,"release":null,"platform":"other","culprit":"","message":"%{[@metadata][sentry][id]}","datetime":"2016-05-24T17:50:31.000000Z","time_spent":null,"tags":[["level","error"],["server_name","10.129.21.17"]],"errors":[{"type":"invalid_data","name":"level","value":"%{[sentry]}"}],"extra":{"severity":6,"facility":10,"@version":"1","@timestamp":"2016-05-24T17:50:31.000Z","sentry":"fatal","logsource":"d27ca252-44d5-45e1-e7e1-d3f3a0212799","priority":86,"host":"10.129.21.17","program":"su","severity_label":"Informational","timestamp":"May 24 17:50:31","message":"pam_unix(su:session): session opened for user root by ubuntu(uid=0)\n","type":"syslog","facility_label":"[Filtered]","pid":"7937"},"fingerprint":["{{ default }}"],"received":1464112251.0,"type":"default","version":"5"} ``` As you can see both the message (msg) and level ("errors":[{"type":"invalid\_data","name":"level","value":"%{[sentry]}"}] ) are not interpolated.. If I have the message like this.. `msg => "[@metadata][sentry][id]" ` it will interpolate.. ```auto {"id":"2cdbe0522f234967855b44c1c17816b0","project":2,"release":null,"platform":"other","culprit":"","message":"10.129.21.17","datetime":"2016-05-24T17:56:45.000000Z","time_spent":null,"tags":[["level","error"],["server_name","10.129.21.17"]],"errors":[{"type":"invalid_data","name":"level","value":"%{sentry}"}],"extra":{"severity":6,"facility":10,"@version":"1","@timestamp":"2016-05-24T17:56:45.000Z","sentry":"fatal","logsource":"d27ca252-44d5-45e1-e7e1-d3f3a0212799","priority":86,"host":"10.129.21.17","program":"su","severity_label":"Informational","timestamp":"May 24 17:56:45","message":"pam_unix(su:session): session opened for user root by ubuntu(uid=0)\n","type":"syslog","facility_label":"[Filtered]","pid":"7971"},"fingerprint":["{{ default }}"],"received":1464112636.0,"type":"default","version":"5"} ``` However the level will NOT no mater how I arange it. ---
**Author:** ![wiibaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wiibaa/32/44931_2.png) [@wiibaa](https://discuss.elastic.co/u/wiibaa)\ **Post date:** [May 24, 2016, 7:17pm UTC](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768/4 "2016-05-24T19:17:52Z")
@joshzitting let's move the discussion to [https://github.com/javiermatos/logstash-output-sentry/issues/1](https://github.com/javiermatos/logstash-output-sentry/issues/1) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768/5 "2017-07-06T04:56:24Z")
Closed on July 6, 2017, 4:56am UTC