elasticsearch - Logstash add dynamic whitelist names based on a filed value

Question

I have a simple Json file log which I need to pass it into elasticsearch. It contains a structure similar to this.

{
  "component_name": "abc",
  "abc": "this is abc",
  "component_action": "action"
}

While passing into elasticsearch, I need to whitelist column names based on the value of the "component_name" field. In the above example, as the component name is "abc", I need to whitelist only "abc" column. I tried to access the field value using [fieldname] syntax but it did not work

whitelist_names => [ "[component_name]" ]

Any help would be appreciated.

question from:https://stackoverflow.com/questions/65931219/logstash-add-dynamic-whitelist-names-based-on-a-filed-value

Answer 1

You need to enable interpolation

whitelist_names => [ "%{component_name}" ]
interpolate => true