Accesing with Logstash to Filebeat parameter fields


(Asier Salueña Sediles) #1

Hi all,

I'm trying new ELK version (6.2), and I'm using the new config options 'fields' to create a field named logtype. I want to detect logs in Logstash using this parameter.

filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/filebeat/filebeat
  fields:
    doc_type: syslog

How can I access to this field in logstash?


(Magnus Bäck) #2

You can access it like any other field, see https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html. If you describe what you want to accomplish it will be possible to provide an example.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.