Custom field name not showing in Filebeat

Elastic Stack Beats
1

Below is how im trying to add a custom fiels name in my filebeat 7.2.0 filebeat.inputs:

- type: log
  enabled: true
  paths:
    - D:\Oasis\Logs\Admin_Log\*
    - D:\Oasis\Logs\ERA_Log\*
    - D:\OasisServices\Logs\*
  processors:
- add_fields:
     fields:
     application: oasis

and with this, im expecting a new field called application whose data entries will be 'oasis' . But i dont get any. I also tried

 fields:
    application: oasis/'oasis'

Help me with this.

2

Are you expecting to find application at the top level of the document? If yes, you need to set target: '' under add_fields as per the documentation. I'd expect you to have a fields.application key in your documents with the configuration you showed.

3

Hi @Magnus_Kessler,
I just tried the below, but no luck,

processors:
- add_fields:
    target: 'input'
    fields:
      appname: oasis

Am i missing something?

4

Your example should work. However, please check your indentation levels in the YAML file. The original example had processors nested inside of a log input.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.