Adding custom field to output

Elastic Stack Beats
1

Im wondering if this is still accurate. Im attempting to add some fields to 'system.yml' (as a test) as follows:

(note that indents are being lost)

  • add_fields:
    target:
    fields:
    name: myproject
    id: '574734885120952459'
    os: ${os.version:def}

I start metricbeat as so:

metricbeat -v -e -E os.version="$(cat /etc/redhat-release)"

When I look at the results I see the name, id values but not my additional value. Just 'def'.

If I use just ${os} per the link above I get an error message at startup:

Error creating runner from config: 1 error: fail to unpack the add_fields configuration: 
missing field accessing 'processors.1.add_fields.fields.os' (source:'/etc/metricbeat/modules.d/system.yml')

Running 7.6 across the board. Wondering if there are updates to how to do this.

2

Hi!

It seems to work on my end with the latest master branch:

Configuration:

processors:
  - add_fields:
      target: project
      fields:
        name: myproject42
        id: '574734885120952459'
        os: ${os.version}

master ● cat /tmp/version                                                                           
19.0.1
master ● ./metricbeat -e -d metricbeat -E os.version=$(cat /tmp/version)

Result:

  "project": {
    "name": "myproject42",
    "id": "574734885120952459",
    "os": "19.0.1"
  },

The value you are seeing def is the default value when the env variable is not present.

3

Interesting. I wonder what Im missing.

If the values for any of those vars changed - would it be reflected in the output? Or is it static?

4

I would say static. They are loaded once during configuration loading.

C.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.