Search code examples
elasticsearchlogstashkibanalogstash-configurationfilebeat

Logstash add dynamic whitelist names based on a filed value

I have a simple Json file log which I need to pass it into elasticsearch. It contains a structure similar to this.

{
  "component_name": "abc",
  "abc": "this is abc",
  "component_action": "action"
}

While passing into elasticsearch, I need to whitelist column names based on the value of the "component_name" field. In the above example, as the component name is "abc", I need to whitelist only "abc" column. I tried to access the field value using [fieldname] syntax but it did not work

whitelist_names => [ "[component_name]" ]

Any help would be appreciated.

Solution

  • You need to enable interpolation

    whitelist_names => [ "%{component_name}" ]
interpolate => true