Accesing with Logstash to Filebeat parameter fields

(Asier Salueña Sediles) #1

Hi all,

I'm trying new ELK version (6.2), and I'm using the new config options 'fields' to create a field named logtype. I want to detect logs in Logstash using this parameter.

- type: log
  enabled: true
    - /var/log/filebeat/filebeat
    doc_type: syslog

How can I access to this field in logstash?

(Magnus Bäck) #2

You can access it like any other field, see If you describe what you want to accomplish it will be possible to provide an example.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.