Add custom metadata to events

[justinw (Justin Walz)]

Hi,

Is it possible to add custom metadata to events?

I like the concept of meta.cloud.* and would like to add something like ec2 tags to that, nested under meta.cloud.tags.* for everything on that instance.

Alternatively, it'd be nice to be able to whitelist environment details, perhaps meta.env.ENV_VAR_NAME=$value.

Does support like this exist in metricbeat (or beats lib?).

Currently I'm sending metricbeat events to logstash, and adding the context there, but it'd be nice to only manage the single metricbeat instance.

Best, Justin

[Mario_Castro]

Hi @justinw

You can use fields and tags in your modules configuration. Is that what you need?

Regards!

[justinw (Justin Walz)]

Yes, that'll definitely work. Thanks!

[justinw (Justin Walz)]

Hi @Mario_Castro,

So I finally got around to trying this, and I was able to successfully set a field like meta.tags.*

However I'd like to nest it with the cloud block, at meta.cloud.tags.*. It seems like the add cloud processor overwrites any fields that might already be there. Is that the case? If so, is there any way to achieve that?

Best, Justin

[ruflin]

The rename processor could help you here: https://www.elastic.co/guide/en/beats/filebeat/6.6/rename-fields.html

For things like Cloud fields I would recommend to follow ECS long term: https://github.com/elastic/ecs In 7.0 these fields will be mapped to ECS.

[justinw (Justin Walz)]

Awesome, thanks @ruflin for the link. I opened a ticket to get a conversation started around standardizing cloud tags/labels in future releases (ref https://github.com/elastic/ecs/issues/384).

For now, I'll keep them where they are since neither is officially a convention yet.

Best, Justin

[ruflin]

Great, thanks for opening the ECS issue.