Adding conditional tags or fields in filebeat.yml

Elastic Stack Beats
1

A) Is there a way to add tags or fields - conditionally in filebeat.

For eg: if the input file is xyz then add tag or field XYZ
if the input file is abc then add tag or field ABC

OR

b) Alternatively can we add tag/field per prospector path ?

  • input_type: log

    paths:

    • /Users/vramakrishnan/work/control-plane/testoutput/cascaded.test.INFO
      fields: {service: "cascade"}
      symlinks: true

  • input_type: log

    Paths that should be crawled and fetched. Glob based paths.

    paths:

    • /Users/vramakrishnan/work/control-plane/testoutput/everest.test.INFO
      fields: {service: "everest"}
2

You can use multiple prospectors for that. Each prospector can have it's own fields / tags.

3

Thanks that worked. Appreciate it.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.