Custom Beat with Multiple Event Field Structures

Elastic Stack Beats
1

I am writing a custom network-related Beat following the "Creating a New Beat" dev-guide.

As part of this Beat, I would like multiple type of events to be produced which would have different field mappings. The above Elastic guide explains how to define the event's fields from the fields.yml file as follow:

- key: countbeat
  title: countbeat
  description:
  fields:
    - name: counter
      type: long
      required: true
      description: >
        PLEASE UPDATE DOCUMENTATION

Is there a way to define multiple event structures and select the appropriate structure when generating the event in the Beat's code? I'm looking to achieve something as follow:

- key: countbeatA
  title: countbeatA
  description:
  fields:
    - name: counter
      type: long
      required: true
      description: >
        Some counter on A

- key: countbeatB
  title: countbeatB
  description:
  fields:
    - name: counter
      type: boolean
      required: true
      description: >
        Whether we use a counter in  B

Thanks in advance!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.