Filter APM metrics with Logstash in Elastic Cloud

[sivachandran (Sivachandran P.)]

I'm using Elastic Cloud. I've integrated APM with my services. The metrics are pushed to APM Server(i.e. deployment) and I can see them in Kibana.

I would like to manipulate certain custom labels of my APM metrics(e.g. IP to Geo). I know I can do this through Logstash(available as part my deployment) pipeline. I tried creating a pipeline with the following pipeline body. But it doesn't the geo field that I'm trying to add. I'm not sure whether Logstash is even receiving the data. Is there any other config I need to do on my deployment to make APM Server route the data through Logstash?

input {
   beats {
       port => 5044
   }
}
filter {
   geoip {
       source => "labels.app_client_ip"
       target => "labels.app_client_geo"

   }
}
output {
   elasticsearch {
       hosts => ["[http://localhost:9200](http://localhost:9200/)"]
       index => "%{[@metadata][index]}"
   }
}

Thanks.

[jalvz (Juan Alvarez)]

Hi,

You would need to configure the Logstash output on apm server if you didn't do that already: https://www.elastic.co/guide/en/apm/server/7.4/logstash-output.html

Apm server provides a geo pipeline by default from versions >= 7.3 which might also suit your needs without requiring Logstash. Check https://www.elastic.co/guide/en/apm/server/7.4/configuring-ingest-node.html

Hope that helps!