Using event fileds in configuration options

[icetimidus]

May I using logstash evnet fileds in grok filter configuration options?

Such as,

    grok { 
        patterns_dir => ["/opt/logstash/patterns/%{[@metadata][some_filed]}"]
        match => {"message" => "%{SOME_PATTERN}"}
    } 

or

    grok { 
        patterns_dir => ["/opt/logstash/patterns/sub"]
        patterns_files_glob => "%{[@metadata][some_filed]}"
        match => {"message" => "%{SOME_PATTERN}"}
    } 

I have try it in logstash 7.6.1 but faild. Any idea?

[kares]

this isn't supported atm, and I am not sure it ever will be. the current work-flow is load the pattern definitions once (for performance reasons) before any events are matched.

the closest one could do is having separate grok plugin instances if-ed based on event data e.g.

filter {
  if [some_field] {
    grok {  
      pattern_definitions => {
        "SOME_PATTERN" => '...'
      }
    }
  }
}