Attempting to add backward compatible field metricset.module


I am using metricbeat 7.3.2, with migration.6_to_7.enabled: true set to get backward compatible fields.

One field that still isn't showing up is metricset.module. Many of our dashboards and alerts depend on this field, so I'd like to add it back via a processor.

However, I'm noticing some weird behavior. Without the following two blocks, other processors work fine (adding, removing, dissecting fields). However when I add either of these, metrics cease to be stored in ES. Is there some block on the metricset target?

Thanks, Justin

      - add_fields:
          target: metricset
            module: kubernetes	
      - dissect:
            has_fields: ['event.module']
          tokenizer: "%{module}"
          field: "event.module"
          target_prefix: "metricset"

Figured it out, posting the resolution for those who find this --

Turns out that there is an alias field for newer versions of metricbeat to handle compatibility.

Even though you won't see the field in the document, if you query for it, it'll return.

The relevant part of the index template for metricbeat 7.3.2

    "metricset": {
      "properties": {
        "module": {
          "type": "alias",
          "path": "event.module"
        "name": {
          "type": "keyword",
          "ignore_above": 1024

-- Justin

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.