Add id processor filebeat

Elastic Stack Beats
1

Hi there,

just want to ask, i have configured filebeat as a container and the filebeat has been ingested millions of logs every minutes. first of all, this is my filebeat config precisely on processor part:

image
image1258×262 55.7 KB

as can you see, i already apply a few processor to add, drop field and event. so,my question is if i add one more processor like this:

- add_id:
    target_field: "custom_id"

whether it will be a performance degradation? i'm afraid it will. because the filebeat was ingested millions even billions logs every day

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.