Hi everyone,
having problem with setting up .yml config file and specificaly processors:dissect.
i have root filebeat.yml file pointing to several config files. This seems to work, in filebeat log i can see that config files are loaded.
But than having problem with setting up these config files
#component-config.yml
- type: log
paths:
- D:\my\path\to\*\*\component\*\*.log
processors:
- dissect:
tokenizer: "%{1}\\%{2}\\%{3}\\%{4}\\%{env}\\%{region}\\%{component}\\%{5}\\%{logname}.log"
field: "source"
- drop_fields:
fields: [1,2,3,4,5]
fields:
app: "my_app"
es_id: "some_id"
es_ver: "some_ver"
correlation_id: "some_c_id"
type: "beats"
application: "some_application"
component: "some_component"
fields_under_root: true
multiline.pattern: '^20'
multiline.negate: true
multiline.match: after
ERROR : Exiting: the processor dissect doesn't exist
dissect part in the documentation is weak and iam a bit flustrated by that issue allready .
Thanks in advance for any tips