如何获取logstash中的字段值？

Question

from my output as below,

"message" =>"<....... ",
"@version" => "1",
"@timestamp" => "2016-04-29T02:33:34.586Z",
"timestamp" => "Apr 29 10:30:37",
"syslog_severity_code" => 5,
"syslog_facility_code" => 1,
"syslog_facility" => "user-level",
"syslog_severity" => "notice"

i try to get the field value

filter
 {
    mutate {
    add_field => {"newfield"=> "timestamp"}
 }

but still cann't get the timestamp value to newfield it's will get

"newfield" => "newfield",

Is anyone is having the same problem or find a solution? Any help is welcome to resolve this.

Answer 1

That`s easy,do it like this:

filter
 {
   mutate {
    add_field => ["newfield"=> "%{timestamp}"]
 }

You can get :

   "message" => "test it \b\b",
  "@version" => "1",
"@timestamp" => "2016-04-28T09:16:56.934Z",
      "host" => "bag",
 "timestamp" => "Apr 29 10:30:37",
 "new_field" => "Apr 29 10:30:37"