explain.txt

Here is the output plugin I am trying to use.. 
https://github.com/javiermatos/logstash-output-sentry

However Sentry is receiving this as the "level_tag" 
{
  "name": "level",
  "value": "%{[sentry_severity]}"
}

But it is also showing the proper string for sentry_severity... sentry_severity: info

here is the debug stdout

{
            "message" => "+ /dev/pts/0 root:root\n",
           "@version" => "1",
         "@timestamp" => "2016-05-12T16:06:30.000Z",
               "type" => "syslog",
               "host" => "10.129.21.17",
           "priority" => 86,
          "timestamp" => "May 12 16:06:30",
          "logsource" => "d27ca252-44d5-45e1-e7e1-d3f3a0212799",
            "program" => "su",
                "pid" => "3897",
           "severity" => 6,
           "facility" => 10,
     "facility_label" => "security/authorization",
     "severity_label" => "Informational",
    "sentry_severity" => "info",
          "@metadata" => {
        "sentry" => {
            "id" => "10.129.21.17"
        }
    }
}

test_logstash.conf

input {
  stdin {
        type => "stdin"
  }
  syslog {
    port => 514
    type => "syslog"
  }

  tcp {
    port => 1514
    type => "cisco-ios"
  }

  udp {
    port => 1514
    type => "cisco-ios"
  }

  tcp {
    port => 2514
    type => "fortigate"
  }

  udp {
    port => 2514
    type => "fortigate"
  }

  tcp {
    port => 3514
    type => "force10"
  }

  udp {
    port => 3514
    type => "force10"
  }
}

filter {
if [type] == "stdin" {
  mutate {
      add_field => {"[@metadata][sentry][id]" => "%{host}"}
      add_field => { "[sentry_severity]" => "%{severity}" }
  }
  mutate {
      gsub => [
        "[sentry_severity]", "0", "fatal",
        "[sentry_severity]", "1", "fatal",
        "[sentry_severity]", "2", "error",
        "[sentry_severity]", "3", "error",
        "[sentry_severity]", "4", "warning",
        "[sentry_severity]", "5", "info",
        "[sentry_severity]", "6", "info",
        "[sentry_severity]", "7", "debug"
      ]
      }
  } else if [type] == "syslog" {
  mutate {
      add_field => {"[@metadata][sentry][id]" => "%{host}"}
      add_field => { "[sentry_severity]" => "%{severity}" }
  }
  mutate {
      gsub => [
        "[sentry_severity]", "0", "fatal",
        "[sentry_severity]", "1", "fatal",
        "[sentry_severity]", "2", "error",
        "[sentry_severity]", "3", "error",
        "[sentry_severity]", "4", "warning",
        "[sentry_severity]", "5", "info",
        "[sentry_severity]", "6", "info",
        "[sentry_severity]", "7", "debug"
      ]
      }
  } else if [type] == "fortigate" {
    mutate {
      add_field => {"[@metadata][sentry][id]" => "%{host}"}
      add_field => { "[sentry_severity]" => "%{severity}" }
    }
    mutate {
      gsub => [ "message", "^<[0-9]+>", "" ]
      gsub => [
        "[sentry_severity]", "0", "fatal",
        "[sentry_severity]", "1", "fatal",
        "[sentry_severity]", "2", "error",
        "[sentry_severity]", "3", "error",
        "[sentry_severity]", "4", "warning",
        "[sentry_severity]", "5", "info",
        "[sentry_severity]", "6", "info",
        "[sentry_severity]", "7", "debug"
      ]
    }
    kv {
      add_field => {
        "timestamp" => "%{date} %{time}"
        "severity_label" => "%{level}"
        "logsource" => "%{devname}"
        "program" => "%{service}"
      }
      add_tag => ["fortigate", "firewall", "security"]
      remove_tag => ["_grokparsefailure","_grokparsefailure_sysloginput"]
    }

    grok {
      match => [ "message", "^.*msg=%{GREEDYDATA:message}" ]
      overwrite => [ "message" ]
    }

    date {
      match => [ "timestamp", "yyyy-MM-dd HH:mm:ss" ]
    }

  } else if [type] == "cisco-ios" {

    grok {
      match => ["message", "<%{POSINT:seqnum1}>%{POSINT:seqnum2}: (\d*: |\.|\*)*%{SYSLOGTIMESTAMP:timestamp} %{WORD:tz}: \%%{WORD:facility_label}-(%{WORD:switch_id}-)*%{INT:severity}-%{WORD:program}: %{GREEDYDATA:message}"]
      remove_field => [ "seqnum1", "seqnum2", "tz" ]
      add_field => { "severity_label" => "%{severity}" }
      overwrite => [ "message" ]
    }

    date {
      match => [ "timestamp",
      "MMM dd HH:mm:ss.SSS",
      "MMM  d HH:mm:ss.SSS"
      ]
    }

    mutate {
      add_field => {"[@metadata][sentry][id]" => "%{host}"}
      add_field => { "[sentry_severity]" => "%{severity}" }
    }
    mutate {
      gsub => [
        "severity_label", "0", "Emergency",
        "severity_label", "1", "Alert",
        "severity_label", "2", "Critical",
        "severity_label", "3", "Error",
        "severity_label", "4", "Warning",
        "severity_label", "5", "Notice",
        "severity_label", "6", "Informational",
        "severity_label", "7", "Debug"
      ]
      gsub => [
        "[sentry_severity]", "0", "fatal",
        "[sentry_severity]", "1", "fatal",
        "[sentry_severity]", "2", "error",
        "[sentry_severity]", "3", "error",
        "[sentry_severity]", "4", "warning",
        "[sentry_severity]", "5", "info",
        "[sentry_severity]", "6", "info",
        "[sentry_severity]", "7", "debug"
      ]
    }
  } else if [type] == "force10" {
    grok {
      match => [ "message", "<%{POSINT:seqnum1}>%{SYSLOGTIMESTAMP:timestamp} %{WORD:tz}: %{DATA:logsource}: \%%{DATA:switch_id} \%%{WORD:facility_label}-%{INT:severity}-%{WORD:program}: %{GREEDYDATA:message}" ]
      remove_field => [ "seqnum1", "tz" ]
      add_field => { "severity_label" => "%{severity}" }
      overwrite => [ "message" ]
    }

    date {
      match => [ "timestamp",
      "MMM dd HH:mm:ss.SSS",
      "MMM  d HH:mm:ss.SSS"
      ]
    }

    mutate {
      add_field => { "[sentry_severity]" => "%{severity}" }
      add_field => {"[@metadata][sentry][id]" => "%{host}"}
    }
    mutate {
      gsub => [
        "severity_label", "0", "Emergency",
        "severity_label", "1", "Alert",
        "severity_label", "2", "Critical",
        "severity_label", "3", "Error",
        "severity_label", "4", "Warning",
        "severity_label", "5", "Notice",
        "severity_label", "6", "Informational",
        "severity_label", "7", "Debug"
      ]
      gsub => [
        "[sentry_severity]", "0", "fatal",
        "[sentry_severity]", "1", "fatal",
        "[sentry_severity]", "2", "error",
        "[sentry_severity]", "3", "error",
        "[sentry_severity]", "4", "warning",
        "[sentry_severity]", "5", "info",
        "[sentry_severity]", "6", "info",
        "[sentry_severity]", "7", "debug"
      ]
    }
  }
}


output {
  elasticsearch {
    hosts => ["10.129.21.40:9200"]
    document_type => "%{type}"
  }
  stdout { codec => rubydebug { metadata => true }}
 # if [severity] < 4 {
    if [type] == "syslog" {
      sentry {
        host => '10.129.21.147'
        key => 'd3921923d34a4344878f7b83e2061229'
        secret => 'd0163ef306c04148aee49fe4ce7621b1'
        project_id => '2'
        msg => "[@metadata][sentry][id]"
#        fields_to_tags => true
        level_tag => "%{sentry_severity}"
      }
    }
    if [type] == 'stdin' {
      sentry {
        host => '10.129.21.147'
        key => 'edbcc2676d814797a43c1330b5f3bf8f'
        secret => '4b3b2226ae024be9895edf5bb2f2d551'
        project_id => '3'
        msg => "[@metadata][sentry][id]"
 #       fields_to_tags => true
        level_tag => "%{sentry_severity}"
      }
    }
#  }
}

this is what sentry receives..

{"id":"ffc45ab403be4ceea08c1f0284fca01f","project":2,"release":null,"platform":"other","culprit":"","message":"%{[@metadata][sentry][id]}","datetime":"2016-05-12T15:58:36.000000Z","time_spent":null,"tags":[["level","error"],["server_name","10.129.21.17"]],"errors":[{"type":"invalid_data","name":"level","value":"%{sentry_severity}"}],"extra":{"severity":6,"facility":10,"message":"pam_unix(sshd:session): session opened for user ubuntu by (uid=0)\n","@version":"1","sentry_severity":"info","logsource":"d27ca252-44d5-45e1-e7e1-d3f3a0212799","priority":86,"host":"10.129.21.17","program":"sshd","severity_label":"Informational","timestamp":"May 12 15:58:36","facility_label":"[Filtered]","type":"syslog","@timestamp":"2016-05-12T15:58:36.000Z","pid":"3771"},"fingerprint":["{{ default }}"],"received":1463068720.0,"type":"default","version":"5"}