Hi,
In the "fields" defintions of filebeat.yml is nesting permitted as follows:
fields:
field_type:
sub_type1: value
sub_type2: value
...which I would then reference in logstash as [fields][field_type][sub_type1].
Regards,
David
Hi David
Is that a conclusion or a question? It was introduced recently here https://github.com/elastic/beats/pull/506
It was a grammatically poor question. But thanks for the confirmation 
I'm getting errors when I try this. My config looks like this:
fields:
cluster:
name: <name>
zone: <zone>
node:
role: <role>
storage: <store>
business:
company: <company>
The error i get is:
2015/12/31 09:42:30.572496 beat.go:107: INFO Init Beat: filebeat; Version: 1.0.1
2015/12/31 09:42:30.573299 main.go:42: CRIT Config error: Error reading config file: YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml: unmarshal errors:
line 40: cannot unmarshal !!map into string
line 43: cannot unmarshal !!map into string
line 46: cannot unmarshal !!map into string. Exiting.
...fail!
The lines referenced correspond to fields,cluster.name, fields,node.role and fields.business.company. How should I be structuring this?
Regards,
David
I actually get the same output when I test it on my machine. @magnusbaeck What is the format that has to be used?
@dawiro I just checked the same config with master and it seems to work. I have to check if some changes perhaps not made it into 1.0.1. Could you try with one of the nightlies? https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/
@dawiro Checked in detail and this is not part of 1.0.1 yet (sorry for the confusion). The feature is available in the 1.1 snapshots.
When is 1.1 due to be released?
It is currently planned for mid/end January, but the snapshot should be stable already.