Logstash make a copy a nested field with mutate.add_field
<p>I wanted to make a copy of a nested field in a Logstash filter but I can't figure out the correct syntax.
Here is what I try:</p>

<p>incorrect syntax:</p>

<pre><code>mutate {
    add_field =&gt; { "received_from" =&gt; %{beat.hostname} }
}
</code></pre>

<p>beat.hostname is not replaced</p>

<pre><code>mutate {
    add_field =&gt; { "received_from" =&gt; "%{beat.hostname}" }
}
</code></pre>

<p>beat.hostname is not replaced</p>

<pre><code>mutate {
    add_field =&gt; { "received_from" =&gt; "%{[beat][hostname]}" }
}
</code></pre>

<p>beat.hostname is not replaced</p>

<pre><code>mutate {
    add_field =&gt; { "received_from" =&gt; "%[beat][hostname]" }
}
</code></pre>

<p>No way. If I give a non nested field it works as expected.</p>

<p>The data structure received by logstash is the following:</p>

<pre><code>{
       "@timestamp" =&gt; "2016-08-24T13:01:28.369Z",
             "beat" =&gt; {
                "hostname" =&gt; "etg-dbs-master-tmp",
                "name" =&gt; "etg-dbs-master-tmp"
    },
            "count" =&gt; 1,
               "fs" =&gt; {
        "device_name" =&gt; "/dev/vdb",
              "total" =&gt; 5150212096,
               "used" =&gt; 99287040,
             "used_p" =&gt; 0.02,
               "free" =&gt; 5050925056,
              "avail" =&gt; 4765712384,
              "files" =&gt; 327680,
         "free_files" =&gt; 326476,
        "mount_point" =&gt; "/opt/ws-etg/datas"
    },
             "type" =&gt; "filesystem",
         "@version" =&gt; "1",
             "tags" =&gt; [
                [0] "topbeat"
              ],
      "received_at" =&gt; "2016-08-24T13:01:28.369Z",
    "received_from" =&gt; "%[beat][hostname]"
}
</code></pre>