Fields.stage is empty


(roland plambeck) #1

Winlogbeat 5.3 and logstash 5.2.xx,I I would want in the elastic index fill a field named field.stage with an string like win or so. But i can't find an Statement in winlogbeat yml to do this.

Example:
#event_id 9,002
tfields.projekt win
tfields.stage unknown
tkeywords Classic
So Index is "logstash-unknown-wineventlog-2017.05.19"

Any help? i would be glad


(roland plambeck) #2

ok; Problem is solved, only a Problem with my Editor and yml-file ; thanks


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.