Thanks @Badger !
I assume below would work too right?
mutate {
add_field => { "[labels][feed]" => "%{[@metadata][feed1]}" }
add_field => { "[labels][feed]" => "%{[@metadata][feed2]}" }
}
Had another question on the similar topic as the docs are not very clear (to me)
What if i have a CSV with multiple values with the first column as the key and the rest of the columns having values that i want to add to various other fields.
What would be the way to use the translate filter for this scenario?
docs states
It is possible to provide multi-valued dictionary values. When using a YAML or JSON dictionary, you can have the value as a hash (map) or an array datatype. When using a CSV dictionary, multiple values in the translation must be extracted with another filter e.g. Dissect or KV.
Note that thefallbackis a string so on no match the fallback setting needs to formatted so that a filter can extract the multiple values to the correct fields.