Logstash 6.4. not performing in-line variable replacement
up vote
0
down vote
favorite
The following mutate / field addition with specific value is not working
geoip {
default_database_type => "ASN"
source => "dst"
}
mutate {
add_field => [ "[dst_asn]", "%{geoip.asn}" ]
# remove_field => [ "geoip" ]
}
despite the fact the value exists:
? dst_asn %{geoip.asn}
# dst_port 80
? geoip.as_org Amazon.com, Inc.
? geoip.asn 16509
? geoip.ip 54.247.167.6
Any ideas why?
logstash
asked Nov 7 at 11:49
pkaramol
1,78811437
add a comment |
up vote
0
down vote
favorite
The following mutate / field addition with specific value is not working
geoip {
default_database_type => "ASN"
source => "dst"
}
mutate {
add_field => [ "[dst_asn]", "%{geoip.asn}" ]
# remove_field => [ "geoip" ]
}
despite the fact the value exists:
? dst_asn %{geoip.asn}
# dst_port 80
? geoip.as_org Amazon.com, Inc.
? geoip.asn 16509
? geoip.ip 54.247.167.6
Any ideas why?
logstash
asked Nov 7 at 11:49
pkaramol
1,78811437
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
The following mutate / field addition with specific value is not working
geoip {
default_database_type => "ASN"
source => "dst"
}
mutate {
add_field => [ "[dst_asn]", "%{geoip.asn}" ]
# remove_field => [ "geoip" ]
}
despite the fact the value exists:
? dst_asn %{geoip.asn}
# dst_port 80
? geoip.as_org Amazon.com, Inc.
? geoip.asn 16509
? geoip.ip 54.247.167.6
Any ideas why?
logstash
asked Nov 7 at 11:49
pkaramol
1,78811437
The following mutate / field addition with specific value is not working
geoip {
default_database_type => "ASN"
source => "dst"
}
mutate {
add_field => [ "[dst_asn]", "%{geoip.asn}" ]
# remove_field => [ "geoip" ]
}
despite the fact the value exists:
? dst_asn %{geoip.asn}
# dst_port 80
? geoip.as_org Amazon.com, Inc.
? geoip.asn 16509
? geoip.ip 54.247.167.6
Any ideas why?
logstash
logstash
asked Nov 7 at 11:49
pkaramol
1,78811437
asked Nov 7 at 11:49
pkaramol
1,78811437
asked Nov 7 at 11:49
pkaramol
1,78811437
asked Nov 7 at 11:49
pkaramol
1,78811437
asked Nov 7 at 11:49
pkaramol
1,78811437
1,78811437
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
accepted
Doesn't work cause this is not the way to access a nested json object...
This is:
add_field => [ "[dst_asn]", "%{[geoip][asn]}" ]
answered Nov 7 at 11:55
pkaramol
1,78811437
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
accepted
Doesn't work cause this is not the way to access a nested json object...
This is:
add_field => [ "[dst_asn]", "%{[geoip][asn]}" ]
answered Nov 7 at 11:55
pkaramol
1,78811437
add a comment |
up vote
0
down vote
accepted
Doesn't work cause this is not the way to access a nested json object...
This is:
add_field => [ "[dst_asn]", "%{[geoip][asn]}" ]
answered Nov 7 at 11:55
pkaramol
1,78811437
add a comment |
up vote
0
down vote
accepted
up vote
0
down vote
accepted
Doesn't work cause this is not the way to access a nested json object...
This is:
add_field => [ "[dst_asn]", "%{[geoip][asn]}" ]
answered Nov 7 at 11:55
pkaramol
1,78811437
Doesn't work cause this is not the way to access a nested json object...
This is:
add_field => [ "[dst_asn]", "%{[geoip][asn]}" ]
answered Nov 7 at 11:55
pkaramol
1,78811437
answered Nov 7 at 11:55
pkaramol
1,78811437
answered Nov 7 at 11:55
pkaramol
1,78811437
answered Nov 7 at 11:55
pkaramol
1,78811437
1,78811437
add a comment |
add a comment |
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53188879%2flogstash-6-4-not-performing-in-line-variable-replacement%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
