I am using filebeat as follows:
- inputs disabled
- modules enabled
- output to logstash
In that situation how can I add custom fields under root to all outgoing traffic? i see a processor for it in 7.0 but it is unclear how it should be done in 6.x...