Filebeat host ip address in Logstash

Elastic Stack Beats
1

Hello,

I've configured Filebeat on application host and ELK stack on another. Everything working good, but i have just beat.hostname and beat.name fileds in Logstash.

Is there a way to retrieve IP address of my application host?

2

Currently Filebeat doesn't export the IP address, but you can configure Filebeat to add an additional field that contains a static IP address that you configure in each configuration file. Please check fields option.

fields:
ip_address: 192.168.3.4

If this doesn't help you, feel free to open a new feature request here.

3

Hi Monica,
How do i access this custom variable ip_address on logstash end?

Thanks

4

You should be able to access in the same way as any other field with fields.ip_address.

5

Hi ruflin,
I am new to filebeat and logstash, i tried the following and i get an exception on logstash end
logstash configuration:
input { beats { port => 5044 type =>trial samplevar => fields.portvariable } }

portvariable i am passing from filebeat. In anycase logstash throwing exception, saying invalid config. Please lmk what is wrong with the config

6
  1. accessing variables in logstash is via [fields][portvariable]
  2. what's samplevar option in beat input plugin? This config option is not supported by logstash

See logstash config docs + ongoing sub-chapters for logstash config file syntax: https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html

For manipulating events check out the docs filters section.