Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Generating filebeat custom fields

I have an elasticsearch cluster (ELK) and some nodes sending logs to the logstash using filebeat. All the servers in my environment are CentOS 6.5.

The filebeat.yml file in each server is enforced by a Puppet module (both my production and test servers got the same configuration).

I want to have a field in each document which tells if it came from a production/test server.

I wanted to generate a dynamic custom field in every document which indicates the environment (production/test) using filebeat.yml file.

In order to work this out i thought of running a command which returns the environment (it is possible to know the environment throught facter) and add it under an "environment" custom field in the filebeat.yml file but I couldn't find any way of doing so.

Is it possible to run a command through filebeat.yml? Is there any other way to achieve my goal?

like image 815
Shachar Ashkenazi Avatar asked Apr 08 '16 06:04

Shachar Ashkenazi


Video Answer


3 Answers

In your filebeat.yml:

filebeat:
  prospectors:
    -
      paths:
        - /path/to/my/folder
      input_type: log

      # Optional additional fields. These field can be freely picked
      # to add additional information to the crawled log files
      fields:
        mycustomvar: production
like image 165
Michael Cho Avatar answered Oct 06 '22 16:10

Michael Cho


in filebeat-7.2.0 i use next syntax:

processors:
- add_fields:
    target: ''
    fields:
      mycustomfieldname: customfieldvalue

note: target = '' means that mycustomfieldname is a top-level field official 7.2 docs

like image 45
Dmitry Perfilyev Avatar answered Oct 06 '22 16:10

Dmitry Perfilyev


Yes, you can add fields to the document through filebeats.

The official doc shows you how.

like image 22
Alain Collins Avatar answered Oct 06 '22 17:10

Alain Collins