Filebeat how to get content of field

Elastic Stack Beats
1

Hello

I have got a flow from openshift where filebeat get logs from applications and send it to logstash.
In logstash i can read value of app name and send logs to dedicated kafka topic.
I'm using "%{[kubernetes][labels][app]}" to get content of field - it works fine.

Question: am I able to do the same in filebeat? Read content of field?
I have tried do the same on filebeat but i got error:
missing field accessing - it's look like there is no that field yet.
In filebeat conf file I have '${[kubernetes.labels.app]}'

2

Hey @Lukolas, welcome to discuss :slight_smile:

On what part of filebeat configuration you are trying to use this field? If the setting accepts using fields, i think you should put it as %{[kubernetes.labels.app]}.

3

Hey @jsoriano
You' re right %{[kubernetes.labels.app]} works for output.kafka - > topic filed, because is dynamically.
I wrongly assumed all value in connfiguration file can be dynamically and i have tried to add custom filed before output with name of topic with reference to filed kubernetes.labels.app.
My new custom fileds value was string from field name.

Thank You @jsoriano

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.