EREG in input to apply in tags value


I'm starting working with filebeat and I want add tag with the value of regular expression in path

- paths:
    - /mnt/ssd/(.*).log --> EREG to obtain the application name 
  tags: [$app]   --> tagging with the application name

Could I do this? Apologies for my english, I tried to explain me as well as I can.

I think this feature could be expand CPU resources but i think simplifies the redeploy filebeat docker


What you mean with expand/add tag with the value of a regular expression? You want to set a different tag per log line?

Filebeat currently does not parse/grok content. To me this sounds like a task for Logstash or elasticsearch ingest node.

Yes! Let me share my use case

I'm working in cloud environment there are new application every week
It could be useful add a tag value parsed from file path dinamycally without restart the filebeat.
Personally, I think it could be possible for new versions of filebeat, metricbeat or any log shipper application...

While it's not fully clear to me how you want to compute the tag in a general way (especially for metricbeat), it sounds like this enhancement request might be helpful.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.