Closed jgough closed 2 years ago
It seems impossible to inject nested data into an event using the fields section of the test config
fields
If I create a test case with the following value for the fields section:
fields: test1: "foo" "[test2][test3]": "bar"
Then an event is created that has the fields
test1: "foo" test3: "bar"
Digging into the generated config it looks the correct field is being added to the json dictionary for __lfv_fields:
__lfv_fields
{"0":{"test1":"foo","[test2][test3]":"foo"}}
But when the translate filter is called (before __lfv_ruby_fields is run) then it adds the following:
__lfv_ruby_fields
"@metadata" => { "__lfv_fields" => { "test1" => "foo", "test3" => "bar" }
So this looks like the underlying issue may actually be an issue with logstash-filter-translate not unpacking nested values correctly?
It seems impossible to inject nested data into an event using the
fields
section of the test configIf I create a test case with the following value for the
fields
section:Then an event is created that has the fields
Digging into the generated config it looks the correct field is being added to the json dictionary for
__lfv_fields
:But when the translate filter is called (before
__lfv_ruby_fields
is run) then it adds the following:So this looks like the underlying issue may actually be an issue with logstash-filter-translate not unpacking nested values correctly?