Accesing with Logstash to Filebeat parameter fields

Hi all,

I'm trying new ELK version (6.2), and I'm using the new config options 'fields' to create a field named logtype. I want to detect logs in Logstash using this parameter.

filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/filebeat/filebeat
  fields:
    doc_type: syslog

How can I access to this field in logstash?

You can access it like any other field, see https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html. If you describe what you want to accomplish it will be possible to provide an example.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.