I am trying to add an tag for the logs of packetbeat before it sends to elasticsearch.
Packetbeat send his logs to logstash. In the logstash pipiline file i want to try to add an tag only for logs of packetbeat but I don't understand how because there is one input (pipeline) file for all beats on the same port.
I don't know how to specify an tag only for one beat.
Hope someone can help me.
You can add tags directly in packetbeat configuration:
# The tags of the shipper are included in their own field with each
# transaction published. Tags make it easy to group servers by different
# logical properties.
tags: ["service-X", "web-tier"]
This will add a
tags field to each event with the specified tags.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.