Add_field doesn't work


#1

Dear all,

I install metric beat on a window server to receive log. I tried to combine some of the field using add_field but it cannot capture the old field value. Any idea?

if "metricbeat" in [tags]{
mutate {
add_field => {
"process.summary" => "%{system.process.username} %{system.process.name} %{system.process.cmdline}"
}
}
}

result

process.summary %{system.process.username} %{system.process.name} %{system.process.cmdline}

Thanks


(Christian Dahlqvist) #2

I think you are referencing nested fields incorrectly. This should probably be:

"process.summary" => "%{[system][process][username]} %{[system][process][name]} %{[system][process][cmdline]}"

#3

But I really have field name which are "system.process.username", "system.process.name", "system.process.cmdline". And I want to combine these field so I use add_field


(Christian Dahlqvist) #4

The fact that the string contains your pattern typically indicates that the field you have specified does not exist or is incorrectly specified. Output the event using a stdout plugin with a rubydebug codec to troubleshoot this. Then you will see exactly what your event looks like.


#5

I tried to use rubydebug codec as output but still fail

if "metricbeat" in [tags]{
stdout { codec => rubydebug }
elasticsearch {
hosts => ["1.1.1.1:9200","2.2.2.2:9200"]
manage_template => false
index => "metricbeat-%{+YYYY.MM}"
}
}


(Christian Dahlqvist) #6

What does the output to stdout look like?


#7

Here's the sample


(Christian Dahlqvist) #8

That is not the output from the stdout plugin. What does a full event look like when you look at it in Kibana?


#9

Do you mean this one?


(Christian Dahlqvist) #10

As you can see your fields are nested. Did you even try the example I provided earlier?


#11

Yes, I have tried but the result still same. May I know if any configuration wrong?

Filter

if "metricbeat" in [tags]{
mutate {
add_field => {
"process.summary" => "{system.process.username} {system.process.name}"
}
}
}

Output

else if "metricbeat" in [tags]{
stdout { codec => rubydebug }
elasticsearch {
hosts => ["192.168.6.27:9200","192.168.6.28:9200"]
manage_template => false
index => "metricbeat-%{+YYYY.MM}"
}
}

Result

Json Output


(Christian Dahlqvist) #12

That is wrong as it is missing % ahead of the curly braces and also use the dot notation. Did you try this:

"process.summary" => "%{[system][process][username]} %{[system][process][name]} %{[system][process][cmdline]}"

If you did, please show us the output.


#13

I tried to change configuration and it works now. Thanks a lot!!!


(system) #14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.