Add tags in filebeat modules

Elastic Stack Beats
#1

Hello,
I have read this information:

Can I add a tag in ibmmq module ? tried with:

 errorlog:
    enabled: true
    var.paths: ["/var/mqm/qmgrs/*/errors/*.json"]
#    json.tags: ibmmq
#    tags: ["ibmmq", json]

and after that in logstash:

filter {
#   if "ibmmq" in [tags] {
     json {
        source => "message"
        target => "message"
     }
#   }
}

Nothing is happening in this way.
If I add # - all is fine..

thank you

#2

I have added :

if [event][module] == "ibmmq" {
...
}

hopefully, this is the correct way - to read the fields from the incoming json.

#3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.