Hi! In a Filebeat input I have a processor in Filebeat like this: processors: - add_fields: when: regexp: message: '[0-9]{8}\-?[a-zA-Z]' fileds: newfield: XXX So, when a new line gets to this processor it tests agains that regex and if it matches, it adds a new fi…

Dynamic value of the add_field processor

ChrsMark (Chris Mark) January 28, 2020, 12:57pm 2

Hi!

I would suggest to go with processor-script so as to programmatically identify and replace the field.

C.

Topic		Replies	Views
Add_fields processor not working Beats	2	609	September 7, 2019
What is the difference between processor add_fields and regular "fields:" Beats filebeat	3	589	November 26, 2019
Add_field Logstash	5	1035	July 6, 2017
How to get the value of a key in the created field using add_fields processor? Beats metricbeat	5	388	June 5, 2020
Filebeat processor syntax 7.12.1 Beats filebeat	13	1081	June 6, 2021

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Dynamic value of the add_field processor

Related topics