logstash parse dynamically json to add new fields in the output

Question

I have the following JSON INPUT:

{
    "ts": "1459504800000",
    "data": "30.7",
    "sid": "1"
}

Whit this filter:

filter {
    mutate {
            convert => { 
            "data" => "float"
            "ts" => "integer" 

        }

    }

    date { 
        match => [ "ts", "UNIX_MS"]
            target => "ts_date"
    }
}

I get the following result:

{
            "ts" => 1459504800000,
          "data" => 30.7,
           "sid" => "1",
      "@version" => "1",
    "@timestamp" => "2016-04-21T14:29:54.241Z",
          "type" => "redis-input",
       "ts_date" => "2016-04-01T10:00:00.000Z"
}

I would like to add a new field in the result composed dynamically with "data" and "sid" parameters values (1 and 30.7) of the input. This field should be somthing like "somestring"+"1" => 30.7

Thanks!

Answer 1

This is what add_field is for. For tasks like this that are unrelated to other filters, I'd use it in mutate:

mutate {
    add_field => { "something%{sid}" => "%{data}" }
}

The value would be a string at this point. If you want it to be numeric, you'd need a second mutate using the convert function.