Arithmetic operations in metricbeat processors

Elastic Stack Beats
1

I am trying to add the below metricbeat processor in system.yml file for adding a custom field. It does not throw any error but does not compute and add the field as well. Is it possible to perform arithmetic operations in the metricbeat module yaml files ? If yes, what is the right syntax?

- add_fields:
    when:
      range:
        (system.cpu.total.pct/system.cpu.cores):
              gte: 0.3
        (system.cpu.total.pct/system.cpu.cores):
              lt: 0.7
   target: ''
   fields:
     status: AMBER
2

Hi @naveenbangalore :slight_smile:

add_fields functionality is limited to what you can see in this link https://www.elastic.co/guide/en/beats/filebeat/master/add-fields.html

You can achieve something like this with an Ingest pipeline https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.