This would be easier to debug if you posted the ruby debug output of an example event.
Are you sure that the field is actually called "dst" and not " dst" or something like that? (That would explain why the first one works and could easily be solved by the trim_key option in the kv filter)
1 Like