Adding custom fields doesn't work in Winlogbeat

Elastic Stack Beats
1

Hi,

I am trying to add custom fields and I don't see field added to the event. Winlogbeat logs show following logs

WARN EventLog[CustomLog] Open() error. No events will be read from this source. The specified channel could not be found. Check channel configuration.

Here is what I am using,

winlogbeat.event_logs:
  - name: Application
    level: error
  
  - name: CustomLog
    fields:
      test_field: webserver

Can someone please say what the issue might be

2

It looks like CustomLog is not a valid event log. You can run Get-EventLog * in PowerShell to get a list of valid event logs. Have you read through Configuring Winlogbeat? It contains detailed information on this topic.

If your goal was to add fields to Application logs, you may want to simply try adding your fields declaration to the Application config block, like so:

winlogbeat.event_logs:
  - name: Application
    level: error
    fields:
      test_field: webserver
3

Thanks Andrew. Will try it.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.