Create New Fields from Metricbeat

Hi guys, i want to ask how to create new fields from metricbeat value like for network monitoring.
i want to create query PPL from metricbeat value but the value is null, i think because the value from is not readable, so im trying to create new fields NetworkInbound for but the value isn't appear.

input {
  beats {
    port => 5044

filter {
      mutate {
        add_fields=> {"NetworkInbound" => ""}

output {
    hosts => [""]
    index => "metricbeat"

after use this metricbeat.conf the value from NetworkInbound only "" string not the value like this

my question is : How to create new fields for, for monitoring network so the TOP 5 VALUES will be appear ?

should i use add_fields at processor metricbeat like this ? or maybe you have an advice for me

  - add_fields:
      target: project
        name: myproject
        id: '574734885120952459'

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.