I found the rename processor for filebeat, couldn't find anything related to a copy field processor. My usecase is I want to copy some fields from the kubernetes processor to a root field with the original fields remaining intact. I have a similar usecase in the case of journalbeat as well. Is there anyway I can do that?
I tried using the fields
, fields_under_root
which instead of deriving the name of the variable use the variable name itself. For eg.
fields:
test: "%{[kubernetes][namespace]}"
makes a field test with value %{[kubernetes][namespace]}
instead of derived value of that actual namespace. Does anyone know a way to do this?