Filebeat: file output with dynamic filename

[james_m (James Masson)]

Hi,

I'm using the file output module to write some container logs to NFS.
I can't figure out how to make the output filename dynamic - I'd like the filename to be the container name.

I suspect I have two options.

1. Set the "filename" option to be a log data field
   I've tried the usual ${log_data_field} syntax, can't get this to work, it just uses this option verbatim.

2. The docs say the default filename is the beat name - rewrite the beat name dynamically.

      - rename:
          fields:
            - from: "container.name"
              to: "@metadata.beat"
          ignore_missing: true
          fail_on_error: true

tried the above - beat and output filename stays the same.

Does anyone have any ideas on this?

thanks

James M

[ylasri (Yassine LASRI)]

check this github

The file output doesn't support using format strings.

[james_m (James Masson)]

Thanks for the pointer!

I'll try something else.