magnusbaeck / logstash-filter-verifier

Apache License 2.0
191 stars 27 forks source link

Not possible to inject nested fields using fields section of config #126

Closed jgough closed 2 years ago

jgough commented 2 years ago

It seems impossible to inject nested data into an event using the fields section of the test config

If I create a test case with the following value for the fields section:

fields:
  test1: "foo"
  "[test2][test3]": "bar"

Then an event is created that has the fields

test1: "foo"
test3: "bar"

Digging into the generated config it looks the correct field is being added to the json dictionary for __lfv_fields:

{"0":{"test1":"foo","[test2][test3]":"foo"}}

But when the translate filter is called (before __lfv_ruby_fields is run) then it adds the following:

  "@metadata" => {
    "__lfv_fields" => {
        "test1" => "foo",
        "test3" => "bar"
    }

So this looks like the underlying issue may actually be an issue with logstash-filter-translate not unpacking nested values correctly?