+8The copy configuration option of a mutate filter in Logstash
is as follows:
filter {
mutate {
copy => { "source_field" => "dest_field" }
}
}Whereas the copy function of the mutate filter in the Chronicle documentation
is as follows:
mutate {
copy => {
"destinationToken" => "sourceToken"
}
}
They seem to be differing in their logic. The destination field is on the left in Chronicle and on the right in Logstash. Which one is correct?
Best answer by ion_
You're probably better off going with the chronicle documentation where possible. I'm not sure if the differences between logstash and chronicle parser syntax are comprehensively documented somewhere, but there seem to have been significant changes made.
I quickly tested this by adding the following into a parser I had open and running a log through it:
# This goes in the top bit where vars are defined
This indicates to me that the argument on the right was used as the source and written over the destination on the left. This is consistent with the Chronicle documentation.
+6You're probably better off going with the chronicle documentation where possible. I'm not sure if the differences between logstash and chronicle parser syntax are comprehensively documented somewhere, but there seem to have been significant changes made.
I quickly tested this by adding the following into a parser I had open and running a log through it:
# This goes in the top bit where vars are defined
This indicates to me that the argument on the right was used as the source and written over the destination on the left. This is consistent with the Chronicle documentation.
+2Technically both code blocks you have pasted are the same. However, the the copy command in the first block is not expanded like it is in the second block. And the second block simply lacks the filter block, but it's understood that the mutate command would be included within the filter block which is why it's not depicted like that in Chronicle documentation. That's because when you create a new parser or a new parser extension, Chronicle prints the filter block for you, whereas logstash does not. The biggest differences between the 2 blocks are the fields being copied and the fields being copied to (if that makes sense?).
If you remove filter, from the first code block and put the source and destination fields on a line of their own; it would look very much the same as the second code block. See below:
mutate {
copy => {
"source_field" => "dest_field"
}
}
Or we can do the opposite and make the second block look like the first by adding the filter block and putting the source and destination fields on the same line as the copy command. If we do so, it would like this:
filter {
mutate {
copy => { "destinationToken" => "sourceToken" }
}
}
Do you see the similarities? Does this make sense?
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.