Filebeat how to get content of field

[Lukolas (Lukas)]

Hello

I have got a flow from openshift where filebeat get logs from applications and send it to logstash.
In logstash i can read value of app name and send logs to dedicated kafka topic.
I'm using "%{[kubernetes][labels][app]}" to get content of field - it works fine.

Question: am I able to do the same in filebeat? Read content of field?
I have tried do the same on filebeat but i got error:
missing field accessing - it's look like there is no that field yet.
In filebeat conf file I have '${[kubernetes.labels.app]}'

[jsoriano (Jaime Soriano)]

Hey @Lukolas, welcome to discuss

On what part of filebeat configuration you are trying to use this field? If the setting accepts using fields, i think you should put it as %{[kubernetes.labels.app]}.

[Lukolas (Lukas)]

Hey @jsoriano
You' re right %{[kubernetes.labels.app]} works for output.kafka - > topic filed, because is dynamically.
I wrongly assumed all value in connfiguration file can be dynamically and i have tried to add custom filed before output with name of topic with reference to filed kubernetes.labels.app.
My new custom fileds value was string from field name.

Thank You @jsoriano