Unable to add new fields in the output event

Elastic Stack Logstash
1

I am trying to add a new field with the name "failed_reason_new". The following filter is not working.

I am getting the below error message.

C:/Demo/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "C:/Demo/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "C:/Demo/logstash-7.1.1/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'",
"org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "C:/Demo/logstash-7.1.1/logstash-core/lib/logstash/java_pipeline.rb:23:in `initialize'", "C:/Demo/logstash-7.1.1/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "C:/Demo/logstash-7.1.1/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}


input {
        jdbc {
               
                jdbc_driver_library => "C:\Ashok\ojdbc8-full\ojdbc8.jar"

                jdbc_driver_class => "oracle.jdbc.Driver"

                jdbc_connection_string => "jdbc:oracle:thin:@new-connection:1234:dbsource"
            
                jdbc_user => "xyz"
                jdbc_password => "xyz"

                schedule => "30 * * * *"

               
                statement => "SELECT * FROM accounts WHERE creation_date > sysdate -1 "
            }
    }
	
	filter {

  mutate {
        
        add_field => { "failed_reason_new" => %{failed_reason}}
    }

  mutate {
    gsub => [      
      "failed_reason_new", "[^a-zA-Z]", ""
    ]
  }
}

    output {
        elasticsearch {
          index => "bank"
          document_type => "account"
          hosts => "localhost:9200"
     document_id => "%{account_no}"
        }
    }
2

The value argument for the Mutate filter's add_field needs to be a quoted string.

Below is a fixed configuration, including whitespace changes to make the structure more readable:

input {
  jdbc {
    jdbc_driver_library => "C:\Ashok\ojdbc8-full\ojdbc8.jar"
    jdbc_driver_class => "oracle.jdbc.Driver"
    jdbc_connection_string => "jdbc:oracle:thin:@new-connection:1234:dbsource"
    jdbc_user => "xyz"
    jdbc_password => "xyz"
    schedule => "30 * * * *"
    statement => "SELECT * FROM accounts WHERE creation_date > sysdate -1 "
  }
}

filter {
  mutate {
    add_field => { "failed_reason_new" => "%{failed_reason}"}
  }

  mutate {
    gsub => [      
      "failed_reason_new", "[^a-zA-Z]", ""
    ]
  }
}

output {
  elasticsearch {
    index => "bank"
    document_type => "account"
    hosts => "localhost:9200"
    document_id => "%{account_no}"
  }
}
3

@yaauie Thank you, it worked

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.