Beats Field Data

Elastic Stack Beats
1

Hi,
In the "fields" defintions of filebeat.yml is nesting permitted as follows:

fields:
field_type:
sub_type1: value
sub_type2: value

...which I would then reference in logstash as [fields][field_type][sub_type1].

Regards,
David

2

Hi David

Is that a conclusion or a question? It was introduced recently here https://github.com/elastic/beats/pull/506

3

It was a grammatically poor question. But thanks for the confirmation :slight_smile:

4

I'm getting errors when I try this. My config looks like this:

  fields:
    cluster:
      name: <name> 
      zone: <zone>
    node:
      role: <role>
      storage: <store>
    business:
      company: <company>

The error i get is:

2015/12/31 09:42:30.572496 beat.go:107: INFO Init Beat: filebeat; Version: 1.0.1
2015/12/31 09:42:30.573299 main.go:42: CRIT Config error: Error reading config file: YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml: unmarshal errors:
line 40: cannot unmarshal !!map into string
line 43: cannot unmarshal !!map into string
line 46: cannot unmarshal !!map into string. Exiting.
...fail!

The lines referenced correspond to fields,cluster.name, fields,node.role and fields.business.company. How should I be structuring this?

Regards,
David

5

I actually get the same output when I test it on my machine. @magnusbaeck What is the format that has to be used?

6

@dawiro I just checked the same config with master and it seems to work. I have to check if some changes perhaps not made it into 1.0.1. Could you try with one of the nightlies? https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/

7

@dawiro Checked in detail and this is not part of 1.0.1 yet (sorry for the confusion). The feature is available in the 1.1 snapshots.

8

When is 1.1 due to be released?

9

It is currently planned for mid/end January, but the snapshot should be stable already.