Creating Custom Field in Kibana and fetching the values from a particular line in message

Elastic Stack Beats
1

Hi All,

We've been using ELK to monitor our network and infrastructure logs. We have a requirement. We need to create a custom field name in filebeat so that we can use it as a unique key to filter the log messages in the Kibana. I've got the following requirements. Requesting the peers to kindly assist.

  1. I need to create a custom field name in filebeat so that it'll be available in the Kibana 'available fields'

  2. I need to dynamically fetch the value of this custom field name from one of the lines (ex: server name: ...) from the messages (log file). I need the value of this field to be fetched from only one occurence in the message source (not each time a new log occurs). (Note: The line from which a particular value needs to be fetched would occcur only once in the messages)

  3. The above two needs to be done for all the logfiles specified in the path.

2

I'm guessing that you want to read about ingest pipelines in Elasticsearch. They allow to modify or add extra fields.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.