Unable to get new field with mutate filter

[zubair_aftab]

i split my array temp as below

if [temp] {
split {
field => "[temp]"
}
}

i get different fields, one of the is : temp.isup_isup_message_type

Then i want to add a new field based on values in this field : temp.isup_isup_message_type

if [temp.isup_isup_message_type] == "65" {
mutate {
add_field => { "test" => "APM" }
}
}

I dont get any syntax error but the field "test" is not getting created.

What am i doing wrong?

[leandrojmp (Leandro Pereira)]

Can you share an example of your message?

Also, you are not referring to nested fields in the correct way.

If you have a field named temp with a nested field named isup_isup_message_type, in logstash you need to use [temp][isup_isup_message_type] in your conditional.

[zubair_aftab]

I have just taken the part from the output to show you:

 "timestamp" => "1640072854196",
      "temp" => [

    [1] {
              "isup_isup_message_type" => "65",
   			}

i tried with [temp][isup_isup_message_type] but not working

[Badger]

@zubair_aftab

      "temp" => [

    [1] {
              "isup_isup_message_type" => "65",
   			}

In that case [temp] is an array, so you would need to use

[temp][1][isup_isup_message_type]

(I assume you removed the [0] entry from the rubydebug output...

[zubair_aftab]

Yes i removed [0].
And thanks it worked with [temp][1][isup_isup_message_type]