Append Field Value to Each Log Message processed by Filebeat

Elastic Stack Beats
1

Hello,

I have a use case where I would like to append a field to each log message that is processed by filebeat. The value would be based upon the type of log read by filebeat.

For instance, lets say I have 3 log types: typeA, typeB, typeC. When filebeat recognizes an update to log type A, it appends a typeA value to each message before output the message.

I have a basic filebeat.yml configured and running, but I cannot figure out how to append data to each message.

Grateful for any insight. thanks

2

Hi, I'll answer my own post. I added a field key/val pair for each log type.

filebeat.inputs:
- type: log
  path: /path_to_my_typeA
  fields:
    name_of_my_additional_field: typeA
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.