There are a few tips related to Logstash, which are described in the following sections.
In the Logstash configuration file, you can refer to a field by its name and can subsequently pass the value of a field into another field. If you want to refer to a top-level field, use the field name directly. If you want to refer to a nested field, use the [top-level field][nested field] syntax. To refer the field, Logstash uses the sprintf format, which helps us to refer to the field values.
The sprintf format is as follows:
%{[top-level field][nested field].....}
For example:
output {
elasticsearch {
document_type => "%{@version}"
index => "logstash_%{type}_%{+YYYY-MM-dd-H}"
}
}
