Create field in Filebeat as Logstash


(leclerc cyril) #1

HI,

i have now logs read from filebeat and they are less cut than logstash , indeed in logstash for example i have the LOG LEVEL field and not in filebeat, how can i proceed to have it please ?

and the new


(Christian Dahlqvist) #2

Filebeat does not parse the log entries, so it is common to send them through Logstash for this type of processing.


(leclerc cyril) #3

thanks, yes but i have 2 problems,

  1. Logstash forwarder is deprecated ( and handler logstash is not good solution because use rescource and have to modify server)
  2. if i use handler i can"t know from what JVM the log come from...

(Magnus Bäck) #4

If you use the fields option that I pointed you to an hour ago, what problem remains?


(leclerc cyril) #5

Hi,

it is not the same issue there is one hour ago is add a field for i know what logs is associated with wat JVM, here i have an information like LOG level in the message i want as a field like logstash... but in message sent there is not the field i want

2016-08-10T11:31:54+02:00 DBG Publish: {
"@timestamp": "2016-08-10T09:31:54.201Z",
"beat": {
"hostname": "rs-tst-int-02",
"name": "rs-tst-int-02"
},
"count": 1,
"fields": null,
"input_type": "log",
"message": "\tjava:app/AofWeb/EntityService!com.real.aof.business.service.EntityService",
"offset": 45708,
"source": "C:\dev\servers\wildfly-9.0.2.Final\domain\servers\server-two\log\server.log",
"type": "log"
}

or thread name, or thread ID , or logger class all those informations are in the message


(Magnus Bäck) #6

First of all you should use Filebeat's multiline feature to join the multilined Java log messages into single events.

Secondly, just as Christian said earlier Filebeat (and logstash-forwarder) doesn't support parsing of message text and extraction of additional fields. You need to use Logstash (or a similar tool).


(leclerc cyril) #7

thank you it is what i wanted to know. I worked on a POC and i think it can be used later.

thank you !


(system) #8

This topic was automatically closed after 21 days. New replies are no longer allowed.