Beat meta info how to show ip?


(michaelshi) #1

Elastic-2.2 version

Every event sent to Logstash contains additional metadata for indexing and filtering:
{
...
"@metadata": {
"beat": "",
"type": ""
}

The beat-meta info :

"@timestamp" => "2016-02-25T01:29:40.264Z",
"beat" => {
"hostname" => "WQ-20151127AMRP",
"name" => "WQ-20151127AMRP"
},

hostname how to show ip?

Thanks


(Magnus Bäck) #2

That's currently not possible. Please check the existing issues at https://github.com/elastic/beats/issues and create a new one if necessary.


(Andrew Kroh) #3

There was a request for this in Logstash. https://github.com/logstash-plugins/logstash-input-lumberjack/pull/3

I think logstash-input-beats would be the best place for this metadata to be added to the event.


(Magnus Bäck) #4

Yes, I agree. The beats input is a better place.


(michaelshi) #5

Thanks everybody.

I used this method

Added ip in tags set.

config.yml
tags: ["topbeat", "192.168.51.105"]

search value 192.168*


(system) #6