Want to Combine Field Values into New Field Value

Elastic Stack Logstash
2 
mutate {
  add_field => {
    "new_field" => "%{oldfield1} %{oldfield2}"
  }
  remove_field => ["oldfield1", "oldfield"]
}

This assumes that add_field is evaluated before remove_field but I'm pretty sure that's the case.

4 Likes