Environment name instead of hostname

[Anagha_nambiar]

Hi All,

Suppose I have installed metricbeat in 3 servers and their machine names are IIS1, IIS2 and IIS3.
If I have to filter metric data for dashboard creation in Kibana, then I used the query "agent.hostname"or "host.name".

It is quite difficult to differentiate servers using hostname. We would rather use environment names like below:

IIS1 - Dev
IIS2 - SIT
IIS3 - PROD

Could you suggest a way or provide some steps on using environment names instead of hostnames for metricbeat in Kibana dashboard?

[Rios]

FB and MB give you an option to define tags or additional fields:

# The tags of the shipper are included in their own field with each
# transaction published.
tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
fields:
  env: staging

This will not have backward values, unless you do reindexing.
If you have a lot of servers, I would use fields.env: dev/SIT/PROD and tags for application, location or something more specific, e.g. app-name, exchange, London, Paris... Tags can have multiple values.

[Anagha_nambiar]

Okay, how can I filter this value from Kibana dashboard?
I have added the environment "Dev" which is having tag as "test" and hostname is "IIS1".

If I give "agent.hostname" query, will I get the "Dev" listed instead of hostname?

[Rios]

No, you will not have the value replacement. Instead you will additional field/tag which will help in the filtering. You will have to modify the dashboard based on named fields.
Use fields.env or fields.hostalias to add a hostname alias.

If you want to replace the value use script processor link

Script Processor | Metricbeat Reference [8.2] | Elastic

[Anagha_nambiar]

Thank you @Rios . That worked!