EREG in input to apply in tags value

[mcortinas (Marc Cortinas Val)]

Hi,

I'm starting working with filebeat and I want add tag with the value of regular expression in path

filebeat.prospectors:
- paths:
    - /mnt/ssd/(.*).log --> EREG to obtain the application name 
  tags: [$app]   --> tagging with the application name
 ....

Could I do this? Apologies for my english, I tried to explain me as well as I can.

I think this feature could be expand CPU resources but i think simplifies the redeploy filebeat docker

Best,
Marc

[steffens (Steffen Siering)]

What you mean with expand/add tag with the value of a regular expression? You want to set a different tag per log line?

Filebeat currently does not parse/grok content. To me this sounds like a task for Logstash or elasticsearch ingest node.

[mcortinas (Marc Cortinas Val)]

Yes! Let me share my use case

I'm working in cloud environment there are new application every week
It could be useful add a tag value parsed from file path dinamycally without restart the filebeat.
Personally, I think it could be possible for new versions of filebeat, metricbeat or any log shipper application...

[steffens (Steffen Siering)]

While it's not fully clear to me how you want to compute the tag in a general way (especially for metricbeat), it sounds like this enhancement request might be helpful.