Filebeat how to get content of field


I have got a flow from openshift where filebeat get logs from applications and send it to logstash.
In logstash i can read value of app name and send logs to dedicated kafka topic.
I'm using "%{[kubernetes][labels][app]}" to get content of field - it works fine.

Question: am I able to do the same in filebeat? Read content of field?
I have tried do the same on filebeat but i got error:
missing field accessing - it's look like there is no that field yet.
In filebeat conf file I have '${[]}'

Hey @Lukolas, welcome to discuss :slight_smile:

On what part of filebeat configuration you are trying to use this field? If the setting accepts using fields, i think you should put it as %{[]}.

Hey @jsoriano
You' re right %{[]} works for output.kafka - > topic filed, because is dynamically.
I wrongly assumed all value in connfiguration file can be dynamically and i have tried to add custom filed before output with name of topic with reference to filed
My new custom fileds value was string from field name.

Thank You @jsoriano

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.