Fields.stage is empty

Elastic Stack Beats
1

Winlogbeat 5.3 and logstash 5.2.xx,I I would want in the elastic index fill a field named field.stage with an string like win or so. But i can't find an Statement in winlogbeat yml to do this.

Example:
#event_id 9,002
tfields.projekt win
tfields.stage unknown
tkeywords Classic
So Index is "logstash-unknown-wineventlog-2017.05.19"

Any help? i would be glad

2

ok; Problem is solved, only a Problem with my Editor and yml-file ; thanks

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.