I have spent quite some time trying to add some tags to Kibana logs yesterday - futilely.
The Kibana logs are in JSON and already contain a "tags" field. The way it looks, Filebeat (maybe beats in general?) chooses not to add tags to an event, if the event has a pre-existing "tags" field - regardless of wether the tags are added via the prospector or "generally".
You also have a sample log event? The tags field must be an array of strings. Checking the source code there might indeed be a problem with the JSON parser not representing the array with the assumed types.
They're really just normal Kibana JSON logs, and tags also contains proper strings:
{"type":"log","@timestamp":"2017-08-22T09:11:11Z","tags":["status","plugin:kibana@5.4.0","info"],"pid":17341,"state":"green","message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","prevMsg":"uninitialized"}
{"type":"log","@timestamp":"2017-08-22T09:11:11Z","tags":["status","plugin:elasticsearch@5.4.0","info"],"pid":17341,"state":"yellow","message":"Status changed from uninitialized to yellow - Waiting for Elasticsearch","prevState":"uninitialized","prevMsg":"uninitialized"}
Thanks. I'd say this is a bug in the parsing/normalization code in filebeat. The post-processing should try to convert the tags value to it's proper type.
I filed this bug report. Feel free to add any context/config/logs/events that might help. Btw. it's tagged for Hacktoberfest if you want to give it a shot
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.