Filebeat 8.8 input configuration - Add Fields

Elastic Stack Elasticsearch
1

Hi,

configuration: [filebeat 8.8] --> [logstash 8.8] --> [elasticsearch 8.8]
I'm trying to add fields in my input configuration but when the data is sent to logstash, the index is created without my field.

using the version 7* I'm able see the new field.

Do you have some hints?

thanks

My Configuration:

filebeat.yaml
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: true
enabled: true

#setup.ilm.enabled: false
#setup.template.enabled: false
#setup.dashboards.enabled: false

filebeat.input:
- type: filestream
id: my_container
enabled: true
paths:
- /var/log/*.container.log
#multiline.pattern: [1]{3}\s[0-9]{1,2},\s[0-9]{4}
#multiline.negate: true
#multiline.match: after
fields:
- my_custom_field: "xxxxxxx"
fields_under_root: true

output.logstash:
hosts:
- logstash

logging.level: info

my_pipeline.conf
input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => [ "elasticsearch:9200" ]
index => "custom-%{+YYYY.MM}"
user => "elastic"
password => "xxxxx"
ssl_certificate_verification => false
manage_template => false
}
}

  1. A-Za-z ↩︎

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.