i have the custom log file which i want to parse and send the logs to ES from the filebeat configuration. So i had the following
- filebeat configuration
filebeat.prospectors: - type: log enabled: true - /tmp/custom.log pipeline: filebeat-custom-pipeline
- ES configuration
1. validated the pipeline with _ingest/pipeline/_simulate 2. posted the ingest pipeline in ES configuration
Now i had to change one field "clientip" type to "geopoint" data type. the article refers in filebeat go for new filebeat module development.
if i you can guide me for alternate way for creating the mapping for fields created out of custom file that would be more helpful.