Add_field doesn't work

Elastic Stack Logstash
1

Dear all,

I install metric beat on a window server to receive log. I tried to combine some of the field using add_field but it cannot capture the old field value. Any idea?

if "metricbeat" in [tags]{
mutate {
add_field => {
"process.summary" => "%{system.process.username} %{system.process.name} %{system.process.cmdline}"
}
}
}

result

process.summary %{system.process.username} %{system.process.name} %{system.process.cmdline}

Thanks

2

I think you are referencing nested fields incorrectly. This should probably be:

"process.summary" => "%{[system][process][username]} %{[system][process][name]} %{[system][process][cmdline]}"
1 Like
3

But I really have field name which are "system.process.username", "system.process.name", "system.process.cmdline". And I want to combine these field so I use add_field

4

The fact that the string contains your pattern typically indicates that the field you have specified does not exist or is incorrectly specified. Output the event using a stdout plugin with a rubydebug codec to troubleshoot this. Then you will see exactly what your event looks like.

5

I tried to use rubydebug codec as output but still fail

if "metricbeat" in [tags]{
stdout { codec => rubydebug }
elasticsearch {
hosts => ["1.1.1.1:9200","2.2.2.2:9200"]
manage_template => false
index => "metricbeat-%{+YYYY.MM}"
}
}

6

What does the output to stdout look like?

7

Here's the sample

Capture
Capture.PNG1082×76 4.83 KB

8

That is not the output from the stdout plugin. What does a full event look like when you look at it in Kibana?

9

Do you mean this one?

Capture2

10

As you can see your fields are nested. Did you even try the example I provided earlier?

11

Yes, I have tried but the result still same. May I know if any configuration wrong?

Filter

if "metricbeat" in [tags]{
mutate {
add_field => {
"process.summary" => "{system.process.username} {system.process.name}"
}
}
}

Output

else if "metricbeat" in [tags]{
stdout { codec => rubydebug }
elasticsearch {
hosts => ["192.168.6.27:9200","192.168.6.28:9200"]
manage_template => false
index => "metricbeat-%{+YYYY.MM}"
}
}

Result

Capture3
Capture3723×27 2.21 KB

Json Output

Capture4
Capture4537×946 35.9 KB

12

That is wrong as it is missing % ahead of the curly braces and also use the dot notation. Did you try this:

"process.summary" => "%{[system][process][username]} %{[system][process][name]} %{[system][process][cmdline]}"

If you did, please show us the output.

1 Like
13

I tried to change configuration and it works now. Thanks a lot!!!

Capture7

14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.