Filebeat field rename does not work

Elastic Stack Beats
1

Hello,
the file rename does not work inmy configuration. Any idea why?
filebeat version is 7.6.0 or 7.6.1 (tested with both).
The logs are shipped to graylog.

 # Set directory for additional inputs:
filebeat.config.inputs:
  enabled: true
  path: /etc/filebeat/conf.d/*.yml

filebeat:
output:
    logstash:
      hosts:
        - 10.247.x.yyy:12204
        - 10.247.x.yyy:12204
        - 10.247.x.yyy:12204
        - 10.247.x.yyy:12204
        - 10.247.x.yyy:12204
      loadbalance: true
processors:
- decode_json_fields:
    fields: ['message']
    target: ""
#    overwrite_keys: true
    max_depth: 4
    add_error_key: true

# rename log_file_path to path to be compatible with logstash
- rename:
    fields:
      - from: "log_file_path"
        to: "path"
#    ignore_missing: true
#    fail_on_error: true

- timestamp:
    field: 'dateTime'
    timezone: 'UTC'
    layouts:
    - '2006-02-01T15:04:05.000 UTC'
    - '01/02/2006 15:04:05.000 UTC'
    test:
    - '12/10/2019 14:44:27.267 UTC'
    - '12/31/2019 14:44:27.267 UTC'

# Logging
logging.level: info  # default info. One of debug, info, warning, error
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.