Adding conditional tags or fields

Hello.
I need Filebeat 7.9.2 to add tags based on content.
What I've tried:

  - add_tags:
        when:
          contains:
           request:"/image/"
        tags: [image]
  - add_tags:
        when:
          contains:
           request:"/api/"
        tags: [api]

Not sure whether it works or not, Filebeat fails to start

Exiting: Failed to start crawler: starting input failed: Error while initializing input: wrong type, expect map accessing 'filebeat.inputs.1.processors.2.add_tags.when.contains'

Please advise what's the issue here and how conditional tagging can be implemented in proper way

Hey @zoulja,

Configuration looks fine, but the error seems to indicate that there is some typo. Try to add a space between the value and the key of request:

  - add_tags:
        when:
          contains:
            request: "/image/"
        tags: [image]
  - add_tags:
        when:
          contains:
            request: "/api/"
        tags: [api]

Please also review the indentation, try to avoid the use of tabs.

If nothing works, share the whole configuration file to see if there is something weird.

Thanks, it really was space issue

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.