Fields Input

[Goyal.vikas87 (Vikas)]

I want to to add a custom field in my all events using FIELDS input in filebeat.yml. Please confirm how I can parameterize the value of the custom field and if possible can I extractt some part of the _source field of the event.

For example:

_source of event 1 = /a/b/job_id1
_source of event 2= /a/b/job_id2

Expected output of fields values:

Say custom field defined in filebeat.yml is JOB ID.

Event 1:
JOB ID = job_id1

Event 2:
JOB ID = job_id2

Please help me if above scenarios can be achieved and if yea then how.

Thanks in advance.

[kvch (Noémi Ványi)]

Yes you can. There is the doc on how you can refer fields from events: https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format-type.html#_format_string_sprintf

May I ask why do you want to add source field to your events? It's already added to every event by Filebeat. So there is no need to add it to your config.

[Goyal.vikas87 (Vikas)]

I do not want to add complete source field but want to extract part of it in other custom field. In my case, source field is different in every event and want to extract that different part in my custom field using parameter.