CODEWITHSUNDEEP
elasticsearchlogstashlogstash-grok
Kris
Kris

Reputation: 342

New field in ELK stack - logstash

I am creating new field and copy data from existing one with:

mutate {
  add_field => { "NewField" => "%{[Old][Field]}" }
}

The problem that I am having is, prior this copy operation the OldField looks well presented in kibana in this way:

{
  "message": "1"
}
{
  "message": "2"
}
{
  "message": "3"
}
{
  "message": "4"
}

After copying the NewField represents the data in one line:

{message=1},{message=2},{message=3},{message=4}

Is there a way to keep the original formatting? The old field is a JSON array, the new field is text.

Thanks!

Upvotes: 0

Views: 134

Answers (1)

Julien Poulin
Julien Poulin

Reputation: 13025

Have you tried using copy instead of add_field?

mutate {
  copy => { "[Old][Field]" => "[NewField]" }
}

Upvotes: 1

Related Questions