Not possible to inject nested fields using fields section of config
jgough opened this issue · 0 comments
jgough commented
It seems impossible to inject nested data into an event using the fields
section of the test config
If I create a test case with the following value for the fields
section:
fields:
test1: "foo"
"[test2][test3]": "bar"
Then an event is created that has the fields
test1: "foo"
test3: "bar"
Digging into the generated config it looks the correct field is being added to the json dictionary for __lfv_fields
:
{"0":{"test1":"foo","[test2][test3]":"foo"}}
But when the translate filter is called (before __lfv_ruby_fields
is run) then it adds the following:
"@metadata" => {
"__lfv_fields" => {
"test1" => "foo",
"test3" => "bar"
}
So this looks like the underlying issue may actually be an issue with logstash-filter-translate not unpacking nested values correctly?