Allocate a type in filebeat

Elastic Stack Beats
1

I am facing a issue my filebeat config is

filebeat.prospectors:

  • input_type: log
    paths:
    • /home/rdave/Desktop/ELK/*
      fields:
      document_type: test
      multiline:
      pattern: '^{"+\w[a-z]'
      negate: true
      match: before
      output.logstash:
      hosts: ['localhost:5044']

I have defined a type to the logs but in kibana I am getting a field which is

fields.document_type test

I only want document_type not fields.documents_type.

A help would be really appreciated

Regards

2

Hello @shrikantgulia, You actually want to use the fields option with fields_under_root, see our doc

It would something like this:

filebeat.inputs:
- type: log
  . . .
  fields:
    document_type: test
  fields_under_root: true
3

@pierhugues Thankyou for the response

I am facing this issue after adding the line
"fields_under_root": true

[root@localhost filebeat-6.2.4-linux-x86_64]# sudo ./filebeat
Exiting: error loading config file: config file ("filebeat.yml") must be owned by the beat user (uid=0) or root

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.