Adding fields to data read by the file plugin

Elastic Stack Logstash
1

Using Filebeat, I can add a field that ends up looking like:

"fields": {
  "fieldname": "value"
},

So far I can't figure out how to do the same with Logstash's file input plugin.

I can't do:

add_field => { "fields.fieldname" => "value" }

Because of the '.'.

I tried:

add_field => { "fields" => { "fieldname" => "value" } }

And logstash threw errors at me.

So, how do I get the File plugin to give me the same output as Filebeat gives me?

From the docs I'm wondering if the plugin just doesn't have the ability to do what I want. Is that true?

2

Quoting the documentation:

The syntax to access a field is [fieldname]. If you are referring to a top-level field, you can omit the and simply use fieldname. To refer to a nested field, you specify the full path to that field: [top-level field][nested field].

1 Like
3

Thanks!