zoulja
(Zoulja)
October 31, 2020, 7:34am
1
Hello.
I need Filebeat 7.9.2 to add tags based on content.
What I've tried:
- add_tags:
when:
contains:
request:"/image/"
tags: [image]
- add_tags:
when:
contains:
request:"/api/"
tags: [api]
Not sure whether it works or not, Filebeat fails to start
Exiting: Failed to start crawler: starting input failed: Error while initializing input: wrong type, expect map accessing 'filebeat.inputs.1.processors.2.add_tags.when.contains'
Please advise what's the issue here and how conditional tagging can be implemented in proper way
jsoriano
(Jaime Soriano)
November 3, 2020, 6:24pm
2
Hey @zoulja ,
Configuration looks fine, but the error seems to indicate that there is some typo. Try to add a space between the value and the key of request
:
- add_tags:
when:
contains:
request: "/image/"
tags: [image]
- add_tags:
when:
contains:
request: "/api/"
tags: [api]
Please also review the indentation, try to avoid the use of tabs.
If nothing works, share the whole configuration file to see if there is something weird.
zoulja
(Zoulja)
November 4, 2020, 9:25am
3
Thanks, it really was space issue
system
(system)
Closed
December 2, 2020, 11:25am
4
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.