Attempting to add backward compatible field metricset.module

Elastic Stack Beats
1

Hi,

I am using metricbeat 7.3.2, with migration.6_to_7.enabled: true set to get backward compatible fields.

One field that still isn't showing up is metricset.module. Many of our dashboards and alerts depend on this field, so I'd like to add it back via a processor.

However, I'm noticing some weird behavior. Without the following two blocks, other processors work fine (adding, removing, dissecting fields). However when I add either of these, metrics cease to be stored in ES. Is there some block on the metricset target?

Thanks, Justin

      - add_fields:
          target: metricset
          fields:
            module: kubernetes	

      - dissect:
          when:
            has_fields: ['event.module']
          tokenizer: "%{module}"
          field: "event.module"
          target_prefix: "metricset"
2

Figured it out, posting the resolution for those who find this --

Turns out that there is an alias field for newer versions of metricbeat to handle compatibility.

Even though you won't see the field in the document, if you query for it, it'll return.

The relevant part of the index template for metricbeat 7.3.2

    "metricset": {
      "properties": {
        "module": {
          "type": "alias",
          "path": "event.module"
        },
        "name": {
          "type": "keyword",
          "ignore_above": 1024
        }
      }
    },

-- Justin

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.