CODEWITHSUNDEEP
elasticsearchlogstashlogstash-configuration
Max
Max

Reputation: 538

What is the difference between %{[field]} and [field] in logstash

could someone tell me what difference is there between you use my field in these two ways? Modify the data type?

Upvotes: 0

Views: 98

Answers (1)

Badger
Badger

Reputation: 4072

In some places %{[field]} can be used to reference the contents of the field. For example

input { generator { count => 1 lines => [ '' ] } }
filter {
    mutate { add_field => { "[Field1]" => "1" } }
    mutate { rename => { "[Field1]" => "[Field2]" } }

    mutate { add_field => { "[Field3]" => "3" } }
    mutate { add_field => { "[Field4]" => "4" } }
    mutate { rename => { "[Field3]" => "%{[Field4]}" } }
}
output { stdout { codec => rubydebug { metadata => false } } }

will produce

         "4" => "3",
    "Field2" => "1",

The first pair of mutates adds a field called [Field1], and then renames it to [Field2]. The second set of mutates renames [Field3] based on the contents of [Field4].

This is called a sprintf reference. It does not work everywhere. It requires the plugin to sprintf the reference and the code does not always do that in places you would expect.

Upvotes: 1

Related Questions