Beats - Define field type with add_fields processor in *beat.yml?

Elastic Stack Beats
1

Looking at this documentation on adding fields, I see that filebeat can add any custom field by name and value that will be appended to every documented pushed to Elasticsearch by Filebeat.

This is defined in filebeat.yml:

processors:
- add_fields:
    target: project
    fields:
      name: myproject
      id: '574734885120952459'

Is there a way, strictly from filebeat.yml, to give fields added here a "type" as well? For example, can I assign "name" to type "keyword" ?

2

Yes, you can use the setup.template.append_fields setting in filebeat.yml. See the documentation and example for this setting on https://www.elastic.co/guide/en/beats/filebeat/current/configuration-template.html.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.