sprintf format doesn't work if the field names are "numbers"

[hummingV]

see: https://discuss.elastic.co/t/reference-numbered-fields-in-sprintf-format/59064

I want to read the following json object in logstash.

    "aggregations": {
        "_percentile": {
            "values": {
                "5.0": 10,
                "95.0": 10
            }

The following doesn't work:

 mutate {
         add_field => { "target" => "%{[aggregations][_percentile][values][5.0]}" }
 }

exception: "reason"=>"Field name [5.0] cannot contain '.'"

Neither the following:

 mutate {
         add_field => { "target" => "%{[aggregations][_percentile][values]['5.0']}" }
 }

No exception but target gets the sprintf string instead of the value. {"target":"%{[aggregations][_percentile][values]['5.0']},...}

Is there a different syntax to read "number" fields? Technically, the field names are quoted. They are valid json syntax and should be treated as strings. Not sure why logstash sprintf format is not able to handle this.

FYI:

% jruby -version
jruby 1.7.19 (1.9.3p551) 2015-01-29 20786bd on Java HotSpot(TM) 64-Bit Server VM 1.8.0_101-b13 +jit [linux-amd64]
% /opt/logstash/bin/logstash -V
logstash 2.3.4
% /opt/logstash/bin/logstash-plugin list --verbose
...
logstash-filter-mutate (2.0.6)
...

[jordansissel]

Short answer, on my phone: sprintf with a field that is a number is assumed to mean an array index, not a string field name.

On Sunday, August 28, 2016, Kyi [email protected] wrote:

see: https://discuss.elastic.co/t/reference-numbered-fields-in- sprintf-format/59064

I want to read the following json object in logstash.

"aggregations": {
    "_percentile": {
        "values": {
            "5.0": 10,
            "95.0": 10
        }

The following doesn't work:

mutate { add_field => { "target" => "%{[aggregations][_percentile][values][5.0]}" } }

exception: "reason"=>"Field name [5.0] cannot contain '.'"

Neither the following:

mutate { add_field => { "target" => "%{[aggregations][_percentile][values]['5.0']}" } }

No exception but target gets the sprintf string instead of the value. {"target":"%{[aggregations][_percentile][values]['5.0']},...}

Is there a different syntax to read "number" fields? Technically, the field names are quoted. They are valid json syntax and should be treated as strings. Not sure why logstash sprintf format is not able to handle this.

FYI:

% jruby -version jruby 1.7.19 (1.9.3p551) 2015-01-29 20786bd on Java HotSpot(TM) 64-Bit Server VM 1.8.0_101-b13 +jit [linux-amd64] % /opt/logstash/bin/logstash -V logstash 2.3.4 % /opt/logstash/bin/logstash-plugin list --verbose ... logstash-filter-mutate (2.0.6) ...

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/logstash-plugins/logstash-filter-mutate/issues/82, or mute the thread https://github.com/notifications/unsubscribe-auth/AAIC6uSFBtkXtTmBrXYxs8lb47kDV3HNks5qkk4pgaJpZM4JvG-1 .

[hummingV]

Sure. I am posting this because an ES team member requested me to. Doesn't concern me much as there is an easy workaround using ruby filter. --Thanks