Adding conditional tags or fields

Elastic Stack Beats
1

Hello.
I need Filebeat 7.9.2 to add tags based on content.
What I've tried:

  - add_tags:
        when:
          contains:
           request:"/image/"
        tags: [image]
  - add_tags:
        when:
          contains:
           request:"/api/"
        tags: [api]

Not sure whether it works or not, Filebeat fails to start

Exiting: Failed to start crawler: starting input failed: Error while initializing input: wrong type, expect map accessing 'filebeat.inputs.1.processors.2.add_tags.when.contains'

Please advise what's the issue here and how conditional tagging can be implemented in proper way

2

Hey @zoulja,

Configuration looks fine, but the error seems to indicate that there is some typo. Try to add a space between the value and the key of request:

  - add_tags:
        when:
          contains:
            request: "/image/"
        tags: [image]
  - add_tags:
        when:
          contains:
            request: "/api/"
        tags: [api]

Please also review the indentation, try to avoid the use of tabs.

If nothing works, share the whole configuration file to see if there is something weird.

3

Thanks, it really was space issue