Substitution in metrics plugin's options only works for meter itself

Elastic Stack Logstash
1

Hello,

I wonder if what I see is a bug, or I have misunderstood something, would very appreciate some help.

I have the next configuration of metrics plugin for Logstash:

filter {
metrics {
meter => "loglines_from_%{host}"
add_tag => [ "metric" ]
add_field => { "machine_name" => "%{host}" }
}
}

This results in the following.

b'{"loglines_from_e34apvl00804":{"rate_1m":129400.26547422142,"count":9902500,"rate_5m":65936.83849025036,"rate_15m":51770.47201063199},"@version":"1","machine_name":"%{host}","tags":["metric"],"message":"e34apvl00804","@timestamp":"2019-10-02T13:25:37.049Z"}'

I.e. the substitution of %{host} works fine in the meter option, but does not work in any other option. I have tried to put %{host} into tags, with the same outcome -- it produces literally '%{host}' in tags instead of substituting it with the hostname of the machine that sent the message.

According to the docs substitution is supposed to work everywhere in options:

I am using Logstash 6.8.1, but I see no difference in documentation for the metrics plugin for the current release and 6.8, it shows examples of substitution everywhere in the options in both cases.

Is something wrong with my configuration, or is it a bug and I should submit it in the tracker?

2

Neither. There is already an issue for it, but I don't think it is a bug.

The metric filter accumulates data about events, then generates a new event containing the accumulated data. The generated event does not have a host field, so you cannot use a sprintf reference to it.

It might be a good idea to document this.

3

Thanks! I suspected that metrics actually throws away the original message after the name of the meter gets created, but got confused by examples in the documentation, that clearly show substitution happening in add_field. I will comment in the issue then or create a new one, requesting the documentation change.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.