Filebeat: file output with dynamic filename

Elastic Stack Beats
1

Hi,

I'm using the file output module to write some container logs to NFS.
I can't figure out how to make the output filename dynamic - I'd like the filename to be the container name.

I suspect I have two options.

  1. Set the "filename" option to be a log data field
    I've tried the usual ${log_data_field} syntax, can't get this to work, it just uses this option verbatim.

  2. The docs say the default filename is the beat name - rewrite the beat name dynamically.

      - rename:
          fields:
            - from: "container.name"
              to: "@metadata.beat"
          ignore_missing: true
          fail_on_error: true

tried the above - beat and output filename stays the same.

Does anyone have any ideas on this?

thanks

James M

2

check this github

3

Thanks for the pointer!

I'll try something else.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.