Filebeat add_fields processor

Elastic Stack Beats
5

Hi @stephenb

I reviewed my implementation and must admit I had an error.

This works for the add_fields processor and the dissect processor in a filestream input.

    processors:
      - add_fields:
          target: ''
          fields:
            event.dataset: "cas.log"
      - if:
          regexp:
            message: '\s\bWARN\s|\s\bERROR\s' # Fetch WARN or ERROR levels into the log.level field
        then:
          - dissect:
              tokenizer: "%{} %{log.level} %{}"
              field: "message"
              target_prefix: ''
              ignore_failure: true
              ignore_missing: true
              overwrite_keys: true

Thanks for your help.

Best regards
Flemming

1 Like