Custom Fields with Module Config

Elastic Stack Beats
1

Is it possible to use custom fields within module config file? What is the appropriate hierarchy?

For example in apache2 module

- module: apache2
  access:
    enabled: true
    var.paths: ["/var/log/apache2/access.log", "/var/log/apache2/other_vhosts_access.log"]
    fields:
      token: <my-token-here>
      type: apache_access

I don't have any issues using "fields" dictionary within inputs but I'm not seeing the custom fields added when using "fields" inside modules.d/apache2.yml

2

Hey @mattz
Please take a look at configuring templates (link) and make sure you have append_fields configured.

if this does not help you can try to run
./filebeat setup --template
on top of that

3

unfortunately I don't have access to elasticsearch.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.