Cannot mutate message in filebeat index created with index template

I cannot mutate a message and add a field if the index is created from a template, having a lifecycle policy.
The pipeline that I am using is:

input {
        beats {
                client_inactivity_timeout => 3000
                port => 5044
                ssl  => false
                type => "beats"

## Add your filters / logstash plugins configuration here
filter {
        mutate {
          add_tag => ["INFO"]
          add_field => {"log.message.type" => "INFO"}

output {
        if [type] == "beats"{
	  elasticsearch {
		hosts => "localhost:9200"
	        index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

The filebeat index, index template, and lifecycle policy are created by uncommenting the following lines in filebeat.yml file:

    #-------------------------- Elasticsearch output ------------------------------
      # Array of hosts to connect to.
      hosts: ["localhost:9200"]

If I comment out the lines above and remove the template and the lifecycle policy, the fields are added successfully to the message.

Can you help me to understand what could be the reason?


I tried with
add_field => {"[log][message][type]" => "INFO"}
But the result is the same

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.