Add id processor filebeat

Hi there,

just want to ask, i have configured filebeat as a container and the filebeat has been ingested millions of logs every minutes. first of all, this is my filebeat config precisely on processor part:

as can you see, i already apply a few processor to add, drop field and event. so,my question is if i add one more processor like this:

- add_id:
    target_field: "custom_id"

whether it will be a performance degradation? i'm afraid it will. because the filebeat was ingested millions even billions logs every day


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.