Add a field when a match between an external dictionary and a field from a filebeat document occurrs

Elastic Stack Beats
1

Hi, in filebeat can I add a field when a match between an external dictionary and a field from a filebeat document occurrs?

Im already doing this with an ingest pipeline and an enrich proccesor, but the ingestion is to slow, and I got others pipelines from logstash running, so I wash thinking maybe I can use the filebeat machine power to do this.

For example in logstash I can create an external dictionary that check if a field match with the key, and add a field with the value of the dictionary

def register(params)
end

def filter(event)
        dic = {
1 => "tcpmux ",
2 => "compressnet",  
3 => "compressnet "
};
        event.set('new_field', dic[event.get("incoming_field")])
        return [event]
end

It is posible something similar in filebeat?

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.