Testing the functionality of using custom fields in order to better sort data for users, but I'v not been able to get it to work properly. In my test case, I have a simple Ubuntu client with metricbeat installed locally and my metrcibeat.yml updated to include:
# Optional fields that you can specify to add additional information to the # output. fields_under_root: true fields: environment: "test" owner: "Me"
with everything set I then pointed it directly at my elasticsearch:9200 and can see the index created (good). However when it comes to visualize that data in kibana, the fields are hidden because they are all empty? To make things more interesting (less?), if i simply watch the logs in /var/log/metricbeat/metricbeat it does regularly post "Total non-zero values" ... but never posts info on those fields?
So I feel like I'm overlooking something obvious ... but really the goal is simple: I want my documents to have custom fields so departments/environments can easily be filtered without being "forced" to create lots of indices.