title: Logstash make a copy a nested field with mutate.add_field
body: <p>I wanted to make a copy of a nested field in a Logstash filter but I can't figure out the correct syntax.
  Here is what I try:</p>
  
  <p>incorrect syntax:</p>
  
  <pre><code>mutate {
      add_field =&gt; { "received_from" =&gt; %{beat.hostname} }
  }
  </code></pre>
  
  <p>beat.hostname is not replaced</p>
  
  <pre><code>mutate {
      add_field =&gt; { "received_from" =&gt; "%{beat.hostname}" }
  }
  </code></pre>
  
  <p>beat.hostname is not replaced</p>
  
  <pre><code>mutate {
      add_field =&gt; { "received_from" =&gt; "%{[beat][hostname]}" }
  }
  </code></pre>
  
  <p>beat.hostname is not replaced</p>
  
  <pre><code>mutate {
      add_field =&gt; { "received_from" =&gt; "%[beat][hostname]" }
  }
  </code></pre>
  
  <p>No way. If I give a non nested field it works as expected.</p>
  
  <p>The data structure received by logstash is the following:</p>
  
  <pre><code>{
         "@timestamp" =&gt; "2016-08-24T13:01:28.369Z",
               "beat" =&gt; {
                  "hostname" =&gt; "etg-dbs-master-tmp",
                  "name" =&gt; "etg-dbs-master-tmp"
      },
              "count" =&gt; 1,
                 "fs" =&gt; {
          "device_name" =&gt; "/dev/vdb",
                "total" =&gt; 5150212096,
                 "used" =&gt; 99287040,
               "used_p" =&gt; 0.02,
                 "free" =&gt; 5050925056,
                "avail" =&gt; 4765712384,
                "files" =&gt; 327680,
           "free_files" =&gt; 326476,
          "mount_point" =&gt; "/opt/ws-etg/datas"
      },
               "type" =&gt; "filesystem",
           "@version" =&gt; "1",
               "tags" =&gt; [
                  [0] "topbeat"
                ],
        "received_at" =&gt; "2016-08-24T13:01:28.369Z",
      "received_from" =&gt; "%[beat][hostname]"
  }
  </code></pre>