In particular, I want to populate cloud.instance.id with the EC2 instance id.

I guess I can hardcode it in the logstash.conf with

filter { mutate { add_field => {"[cloud][instance][id]" => "i-xxxxxxxxxxxxxxxxx"

but I was expecting to get it some programmatic way like

filter { mutate { add_field => {"[cloud][instance][id]" => "%{[@metadata][xxxxxx]}"

Is there anything like that ?