Trying to have dissect clean up after itself

Elastic Stack Logstash
1

I am using dissect to parse a field it has just parsed out of a message.

input { generator { message => 'aaa bbb/ccc ddd' count => 1 } }
output { stdout { codec => rubydebug } }
filter {
    dissect {
        mapping => {
            "message" => '%{a} %{bAndC} %{d}'
            "bAndC" => '%{b}/%{c}'
        }
    }
}

That gets this, which looks good. However I do not need the combined bAndC field

     "bAndC" => "bbb/ccc",
         "a" => "aaa",
         "b" => "bbb",
         "d" => "ddd",
         "c" => "ccc"

So I tried this

input { generator { message => 'aaa bbb/ccc ddd' count => 1 } }
output { stdout { codec => rubydebug } }
filter {
    dissect {
        mapping => {
            "message" => '%{a} %{bAndC} %{d}'
            "bAndC" => '%{b}/%{c}'
        }
        remove_field => [ "bAndC" ]
    }
}

Which gets me this. Is that a bug or a feature?

         "a" => "aaa",
         "d" => "ddd",

( "%{a} %{b}/%{c} %{d}" is not a solution to my problem :slight_smile: )

2

Why is the last option not a solution? It would be easier to help if you actually showed some real data?

3

Actually it is a solution. The subsequent parsing of ccc cannot be done using dissect, but combining the two things I am doing in that dissect works just fine.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.