Hey, I just upgraded to filebeat 8.15.0 and now my filebeat config isn´t working anymore.
If the replacement is an empty string, filebeat wont start.
- replace:
fields:
- field: "host.hostname"
pattern: ".my.domain"
replacement: ""
I get the following error:
{"log.level":"error","@timestamp":"2024-09-03T05:43:17.517Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1349},"message":"Exiting: error initializing processors: failed to unpack the replace configuration: string value is not set accessing 'processors.34.replace.fields.0.replacement' (source:'/etc/filebeat.yml')","service.name":"filebeat","ecs.version":"1.6.0"}
Is there another way I can replace/delete a part of a string in my host.hostname field? Or is this behaviour a bug?
Edit: I changed my replacement from an empty string to a space, but this is a bad workaround because in Kibana I need to add this space after my host.hostname otherwise my filter doesn´t work.
Edit 2: I use the "Script Processor" now, as long as I don´t know if this is a bug or not. Here is my code if anything is facing a similar issue:
- script:
lang: javascript
source: >
function process(event) {
var hostname = event.Get("host.hostname");
var domain = '.my.domain';
var updatedHostname = hostname.slice(0, -domain.length);
event.Put("host.hostname", updatedHostname);
return event;
}