'add_field' and 'tags' can't reference metadata fields
Closed this issue · 0 comments
magnusbaeck commented
The plugin's push_hit method basically looks like this:
def push_hit(hit, output_queue)
event = LogStash::Event.new(hit['_source'])
decorate(event)
# populate metadata fields if docinfo is enabled
output_queue << event
end
Since we're calling decorate(event) prior to the population of the metadata fields any add_field
or tags
options can't reference the metadata fields. Consequently, this configuration won't work:
input {
elasticsearch {
...
docinfo => true
add_field => {
'some-field-name' => "%{[@metadata][_index]}"
}
}
}
Postponing the decorate(event) call until after the metadata population should fix this.