Filebeat nested 'fields' values

Elastic Stack Beats
1

Hello,

I'm looking to use Filebeat to ship logs to our ELK stack cluster.

Editing the yml file, I tried this kind of configuration:

 fields:
    debug: true
    banana:
      split: chocolate

but when starting the beat it doesn't work:
CRIT Config error: Error reading config file: YAML config parsing failed on filebeat.yml: yaml: unmarshal errors: line 39: cannot unmarshal !!map into string. Exiting.

Is it possible to nest fields? If yes , how?

I would like to group related custom fields and refer to them in logstash with the [fields][banana][split] reference.

Thanks
Bruno

2

Nested fields are supported in the yet to be released Filebeat 1.1; see PR #506. You can download a nightly snapshot of something that should be very close to the final 1.1; see links in Insufficient throughput from Filebeat.