# Using metric with dynamic field names
**URL:** https://discuss.elastic.co/t/using-metric-with-dynamic-field-names/88441
**Category:** Logstash
**Created:** [June 6, 2017, 3:08pm UTC](https://discuss.elastic.co/t/using-metric-with-dynamic-field-names/88441 "2017-06-06T15:08:14Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@kbop543](https://discuss.elastic.co/u/kbop543)
#### Post date: [June 6, 2017, 3:08pm UTC](https://discuss.elastic.co/t/using-metric-with-dynamic-field-names/88441/1 "2017-06-06T15:08:15Z")
Hey,
So I have been testing how to use metrics to tell me the count of how many times a logfile logged errors.
I use indexes to distinguish between logfiles by grabbing the filename from the path in a field called filename.
I have tried this in my logstash config file and it works:
metrics {
meter =\> "events"
add\_tag =\> "metric"
}
output {
elasticsearch {
hosts =\> "g-elasticsearch:9200"
manage\_template =\> false
index =\> "%{filename}"
}
stdout {codec =\> rubydebug}
if "metric" in [tags] and [events][count] \> 1{
stdout {
codec =\> line {
format =\> "rate: %{[events][count]}"
}
}
}
}
This will give me the total count of all logs with errors. But I want it per logfile. I have tried various variations of this:
metrics {
meter =\> "%{filename}"
add\_tag =\> "metric"
}
output {
elasticsearch {
hosts =\> "g-elasticsearch:9200"
manage\_template =\> false
index =\> "%{filename}"
}
stdout {codec =\> rubydebug}
if "metric" in [tags] and [%{filename}][count] \> 1{
stdout {
codec =\> line {
format =\> "rate: %{[%{filename}][count]}"
}
}
}
}
this does not work. In /var/log/logstash/.. it says "[2017-06-01T20:48:14,929][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\' for nil:NilClass\>, :backtrace=\>["(eval):175:inoutput\_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:400:in output\_batch'", "org/jruby/RubyProc.java:281:incall'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:227:in each'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:226:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:394:inoutput\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:352:in worker\_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:instart\_workers'"]}"
I know that the syntax is somehow wrong. What is the right syntax? I have tried variations of the above to see which one would work, aka switching around curly braces or quotation marks but nothing seems to work!
Hoping someone can help me,
Thanks
---
### Author:  [@pts0](https://discuss.elastic.co/u/pts0)
#### Post date: [June 6, 2017, 3:56pm UTC](https://discuss.elastic.co/t/using-metric-with-dynamic-field-names/88441/2 "2017-06-06T15:56:23Z")
Hi,
I suppose the problem is in the output part (first of all just format it nice in the post 🙂 ):
```
output {
elasticsearch {
hosts => "g-elasticsearch:9200"
manage_template => false
index => "%{filename}"
}
stdout {codec => rubydebug}
if "metric" in [tags] and [%{filename}][count] > 1{
stdout {
codec => line {
format => "rate: %{[%{filename}][count]}"
}
}
}
}
```
I m not a compiler, but I think the problem is `if "metric" in [tags] and [%{filename}][count] > 1`
Have a look at [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) and make sure your if expression is valid.
To test it try empthy if or something trivial in it, , maybe is `format => "rate: %{[%{filename}][count]}"` the problem.
pts0
---
### Author:  [@kbop543](https://discuss.elastic.co/u/kbop543)
#### Post date: [June 8, 2017, 3:14pm UTC](https://discuss.elastic.co/t/using-metric-with-dynamic-field-names/88441/3 "2017-06-08T15:14:16Z")
The expression is valid because it works totally fine with [events][count] \> 1.
The only different between the following
[events][count] \> 1
[%{filename}][count] \> 1
..is that I added a %{filename} instead of a regular 'events'. Not sure why it won't work. I am assuming there is a syntax to accommodate this dynamic field but it's not documented anywhere...
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 3:14pm UTC](https://discuss.elastic.co/t/using-metric-with-dynamic-field-names/88441/4 "2017-07-06T15:14:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.