Wrong Syntax

Elastic Stack Logstash
1

My Filter in Logstash looks like that:

     } else if "issuer" in [jsonstring] {
                               mutate { add_field => [ "issuer", "%{[jsonstring][issuer]}" ] }

I am getting the following in Kibana:

Wrong Syntax in filter

What is wrong with my syntax? Why I am not getting in the issuer field the value "r"?

Thanks
Sharon.

2

[jsonstring][issuer] means "the field jsonstring with the subfield issuer", i.e. a JSON document that looks like this:

{
  ...
  "jsonstring": {
    "issuer": "..."
  }
}

That's not what you have. You have a jsonstring field containing the string "issuer=r". I suggest you use a kv filter to parse that string and create the issuer field.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.