Add_field doesn't work

[peterch]

Dear all,

I install metric beat on a window server to receive log. I tried to combine some of the field using add_field but it cannot capture the old field value. Any idea?

if "metricbeat" in [tags]{
mutate {
add_field => {
"process.summary" => "%{system.process.username} %{system.process.name} %{system.process.cmdline}"
}
}
}

result

process.summary %{system.process.username} %{system.process.name} %{system.process.cmdline}

Thanks

[Christian_Dahlqvist]

I think you are referencing nested fields incorrectly. This should probably be:

"process.summary" => "%{[system][process][username]} %{[system][process][name]} %{[system][process][cmdline]}"

[peterch]

But I really have field name which are "system.process.username", "system.process.name", "system.process.cmdline". And I want to combine these field so I use add_field

[Christian_Dahlqvist]

The fact that the string contains your pattern typically indicates that the field you have specified does not exist or is incorrectly specified. Output the event using a stdout plugin with a rubydebug codec to troubleshoot this. Then you will see exactly what your event looks like.

[peterch]

I tried to use rubydebug codec as output but still fail

if "metricbeat" in [tags]{
stdout { codec => rubydebug }
elasticsearch {
hosts => ["1.1.1.1:9200","2.2.2.2:9200"]
manage_template => false
index => "metricbeat-%{+YYYY.MM}"
}
}

[Christian_Dahlqvist]

What does the output to stdout look like?

[peterch]

Here's the sample

[Christian_Dahlqvist]

That is not the output from the stdout plugin. What does a full event look like when you look at it in Kibana?

[peterch]

Do you mean this one?

[Christian_Dahlqvist]

As you can see your fields are nested. Did you even try the example I provided earlier?

[peterch]

Yes, I have tried but the result still same. May I know if any configuration wrong?

Filter

if "metricbeat" in [tags]{
mutate {
add_field => {
"process.summary" => "{system.process.username} {system.process.name}"
}
}
}

Output

else if "metricbeat" in [tags]{
stdout { codec => rubydebug }
elasticsearch {
hosts => ["192.168.6.27:9200","192.168.6.28:9200"]
manage_template => false
index => "metricbeat-%{+YYYY.MM}"
}
}

Result

Json Output

[Christian_Dahlqvist]

@peterch

if "metricbeat" in [tags]{
mutate {
add_field => {
"process.summary" => "{system.process.username} {system.process.name}"
}
}
}

That is wrong as it is missing % ahead of the curly braces and also use the dot notation. Did you try this:

"process.summary" => "%{[system][process][username]} %{[system][process][name]} %{[system][process][cmdline]}"

If you did, please show us the output.

[peterch]

I tried to change configuration and it works now. Thanks a lot!!!