EREG in input to apply in tags value

(Marc Cortinas Val) #1


I'm starting working with filebeat and I want add tag with the value of regular expression in path

- paths:
    - /mnt/ssd/(.*).log --> EREG to obtain the application name 
  tags: [$app]   --> tagging with the application name

Could I do this? Apologies for my english, I tried to explain me as well as I can.

I think this feature could be expand CPU resources but i think simplifies the redeploy filebeat docker


(Steffen Siering) #2

What you mean with expand/add tag with the value of a regular expression? You want to set a different tag per log line?

Filebeat currently does not parse/grok content. To me this sounds like a task for Logstash or elasticsearch ingest node.

(Marc Cortinas Val) #3

Yes! Let me share my use case

I'm working in cloud environment there are new application every week
It could be useful add a tag value parsed from file path dinamycally without restart the filebeat.
Personally, I think it could be possible for new versions of filebeat, metricbeat or any log shipper application...

(Steffen Siering) #4

While it's not fully clear to me how you want to compute the tag in a general way (especially for metricbeat), it sounds like this enhancement request might be helpful.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.