Add_tags processor in Filebeat panw module

Elastic Stack Beats
,
1

I am trying to implement the add_tags processor within the panw Filebeat module, but Filebeat fails with the error:

Exiting: each processor must have exactly one action, but found 2 actions (add_locale,add_tags)

add_locale isn't implemented within any other modules or filebeat.yml. I am able to get the add_tags processor to work in other modules.

#Module: panw
# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-panw.html

- module: panw
  panos:
    enabled: true

    # Set which input to use between syslog (default) or file.
    var.input: "file"

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/logname.log"]

    input:
      processors:
        - add_tags:
            tags: [panw]

Is there something I'm doing wrong or is there a potential issue with the panw Filebeat module?

2

Did you try to use single processors field instead of input.processors?

3

I did try that (assuming I did it correctly), which did not throw an error, however, the panw documents do not get tagged.

#Module: panw
# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-panw.html

- module: panw
  panos:
    enabled: true

    # Set which input to use between syslog (default) or file.
    var.input: "file"

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/logname.log"]

    processors:
      - add_tags:
          tags: [panw]
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.