gsub does not substitute from field names

[Akshaykapoor]

Trying in logstash-1.4.2, gsub does not substitute the replace with existing field_names. I tried to achieve the following,

mutate {
  gsub => [ 
    "description", "(\$from)", "%{from}"
  ]
}

[webmstr]

Looks like it doesn't work in either position:

gsub => [ "foo", "%{bar}", "spam" ]

[purbon]

Hi @webmstr not sure what you are trying to archive here, can you provide a bit more details?

just as a clarification gsub => [ "foo", "%{bar}", "spam" ] will try to replace in the foo field the bar value with the word spam, is this what you expect?

[purbon]

As you can see in https://github.com/logstash-plugins/logstash-filter-mutate/blob/master/spec/filters/mutate_spec.rb#L449-L461 this works as expected at less in our tests.

Looking forward to know more,

/cheers

[webmstr]

Here's what I was noticing:

filter {

mutate {
    add_field => { "bar" => "cheers" }
}

mutate {
    add_field => { "foo" => "Three cheers for Joe" }
}

mutate {
  gsub => [ "foo", "%{bar}", "beers" ]
}

}

Results in this:

{ "message" => "asdf", "@version" => "1", "@timestamp" => "2015-09-08T23:41:01.179Z", "host" => "0.0.0.0", "bar" => "cheers", "foo" => "Three cheers for Joe" }

And you would hope for "Three beers for Joe".

Note that the gsub{} succeeds (an add_tag will fire in that stanza).