Accessing nested variables with Logstash

For some reason this doesn't seem to be anywhere on the internet.

Anyhu, the correct way to access this is:

Assuming the input:

{
  "foo" : {
    "bar": "baz"
  }
}

You could get the value of foo.bar with:

"%{foo[bar]}"

or

"%{[foo][bar]}"

Example usage:

mutate {  
  add_field => {
    "other_field" => "%{[foo][bar]}"                        
  }                    
}

.. hope someone finds that useful :)