logstash-plugins/logstash-input-elasticsearch

'add_field' and 'tags' can't reference metadata fields

Closed this issue · 0 comments

The plugin's push_hit method basically looks like this:

def push_hit(hit, output_queue)
    event = LogStash::Event.new(hit['_source'])
    decorate(event)

    # populate metadata fields if docinfo is enabled

    output_queue << event
  end

Since we're calling decorate(event) prior to the population of the metadata fields any add_field or tags options can't reference the metadata fields. Consequently, this configuration won't work:

input {
  elasticsearch {
    ...
    docinfo => true
    add_field => {
      'some-field-name' => "%{[@metadata][_index]}"
    }
  }
}

Postponing the decorate(event) call until after the metadata population should fix this.