Filebeat Configuration: Adding fields in filebeat.yml

Elastic Stack Beats
1

I need to write a filebeat.yml for reading jenkins logs and then stashing the same in ELK.
I have come across this filter and want to implement the same in filebeat.yml. I have made changes accordingly but stuck here in the add_fields part of this filter plugin.

Can anyone help me in adding fields in filbeat.yml similar to the add_field in this filter plugin?

filter_plugin
filter_plugin.JPG723×560 40.3 KB

Filebeat.yml

#=========================== Filebeat inputs =============================

filebeat.inputs:
- type: log
  enabled: true
  paths:
   - /opt/app/elk/logs/jenkins.log 
  multiline.pattern: '^%{MONTH} %{MONTHDAY}, %{YEAR} %{TIME} (AM|PM)'
  multiline.negate: true
  multiline.match: before
2

You could use the add_fields processor in Filebeat to add these fields.

All processors accept an optional when field that can be used to specify the conditions under which the processor is to be executed.

3

Hi @shaunak

Thank you for the solution.
Sorry, but i didn't understand the example given in this add_fields processor.
Could you please help me to add the add_fields in filebeat.yml given above ? :slightly_smiling_face: