Add custom metadata to events


Is it possible to add custom metadata to events?

I like the concept of* and would like to add something like ec2 tags to that, nested under* for everything on that instance.

Alternatively, it'd be nice to be able to whitelist environment details, perhaps meta.env.ENV_VAR_NAME=$value.

Does support like this exist in metricbeat (or beats lib?).

Currently I'm sending metricbeat events to logstash, and adding the context there, but it'd be nice to only manage the single metricbeat instance.

Best, Justin

Hi @justinw

You can use fields and tags in your modules configuration. Is that what you need?


Yes, that'll definitely work. Thanks!

Hi @Mario_Castro,

So I finally got around to trying this, and I was able to successfully set a field like meta.tags.*

However I'd like to nest it with the cloud block, at*. It seems like the add cloud processor overwrites any fields that might already be there. Is that the case? If so, is there any way to achieve that?

Best, Justin

The rename processor could help you here:

For things like Cloud fields I would recommend to follow ECS long term: In 7.0 these fields will be mapped to ECS.

Awesome, thanks @ruflin for the link. I opened a ticket to get a conversation started around standardizing cloud tags/labels in future releases (ref

For now, I'll keep them where they are since neither is officially a convention yet.

Best, Justin

1 Like

Great, thanks for opening the ECS issue.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.