Here is my filebeat config: filebeat.prospectors: - type: log paths: - C:/inetpub/app01/logs/IIS/*/*.log fields: app_group: iis app_id: app01 - type: log paths: - C:/inetpub/app02/logs/IIS/*/*.log fields: app_group: iis app_id: app02 - type: log paths: - C:/i…

Both configurations look OK to me. You don't have fields_under_root set in filebeat, right? I suggest you look at the events in elasticsearch and make sure they really do have [fields][app_group] set.

Discuss the Elastic Stack

Filebeat fields are not working

Elastic Stack Logstash

Badger March 1, 2018, 9:54pm 4

Yes. Look at this post for an example.

Topic		Replies	Views
Multiple IIS logs - Add field (?) Beats filebeat	3	1143	June 20, 2019
Use filebeat added field for logstash conditions Logstash	3	324	August 20, 2019
Logstash Conditional Indexes Logstash	5	4334	March 29, 2019
IIS Log message field doesn't always get parsed Beats filebeat	12	2650	September 5, 2018
IIS logs showing as a string Logs	4	1695	December 7, 2021

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat fields are not working

Related topics