Search code examples
elasticsearchlogstashlogstash-grok

logstash configuration to add / mutate three attributes to a list

I have three attributes coming in from a grok{ } filter, I am trying to add them in a list some thing like this :

parentAttrName:[
     iEDate : iEDateValue,
     iLNum : iLNumValue,
     iQ : iQValue
]

I have used add_tag => ["%{ilmdExpirationDate}","%{iLNumValue}","%{iQValue}"] in grok but it is adding only value of these attributes in a list named tags.

like this :

"tags": [
           "2017-07-02",
           "OT-365",
           "365",
           "2016-10-10T10:14:35.000000010"
]
Solution

  • Try to add this mutate filter:

    filter {
   mutate {
      add_field => {
          "[parentAttrName][iEDate]" => "%{ilmdExpirationDate}"
          "[parentAttrName][iLNum]" => "%{iLNumValue}"
          "[parentAttrName][iQ]" => "%{iQValue}"
      }
   }
}