6.7.1: Regarding Custom Fields

Elastic Stack Beats
1

Hi,
I am using filebeat as follows:

  • inputs disabled
  • modules enabled
  • output to logstash

In that situation how can I add custom fields under root to all outgoing traffic? i see a processor for it in 7.0 but it is unclear how it should be done in 6.x...

Regards,
D

2

You should be able to use the top-level fields setting to define your fields. Also, you can set the top-level fields_under_root setting to true.

Shaunak

3

Take a look at this - SOLVED - Index Template for filebeat - fails on fields. I have this working and just had an issue initializing template since I was using beats -> Logstash -> ES which the team helped solve.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.