EFK | Filebeat

Elastic Stack Beats
, ,
1

[2023-10-16 12:43:41] | DEBUG | watch_dir | django.utils.autoreload | Watching dir /home/hassan/Documents/PROJECTS/vault-api/venv/lib/python3.10/site-packages/oauth2_provider/locale with glob.

I have a log file above with "|" seprated and i want to dissect and tokenize it with filebeat processors and put the value in add_fields fields. Please correct me if i am doing wrong thanks

Example:

filebeat.inputs:

  • type: log
    enabled: true
    paths:
    • /usr/share/filebeat/logs/*.log
      multiline.pattern: '^['
      multiline.negate: true
      multiline.match: after

output.elasticsearch:
hosts: ["elasticsearch:9200"]

processors:

  • dissect:
    tokenizer: '"[%{asctime}] | %{levelname} | %{funcName} | %{name} | %{message}"'
    field: "message"
    target_prefix: ""

  • add_fields:
    target: Project
    fields:
    Time: "%{asctime}"
    Level: "%{levelname}"
    Function: "%{funcName}"
    Name: "%{name}"
    Message: "%{message}"

2

Hi @Hassan_Ahmed

By default filebeat is having "message" field, so won't be able to create a new field with same name.

Could you please try below without add_fields. Following contents will automatically add field name mentioned in {}.

  • dissect:
    tokenizer: '%{asctime} | %{levelname} | %{funcName} | %{name} | %{message_new}'
    field: "message"
    target_prefix: ""

Thanks..!!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.