From logstash-forwarder to filebeat, how can use tags?

Elastic Stack Beats
1

Hi, i have converted my old configuration for logstash-forwarder to filebeat, in this way:

filebeat:
  prospectors:
    -
     paths:
       - /var/log/httpd/access_log
     input_type: log
     document_type: apache
     fields:
       tags: {"mytag"}
     fields_under_root: true

##### Output ####

output:
  logstash:
    hosts: ["logstash_ip"]

##### Logging ####

logging:
  to_files: true
  files:
    path: /var/log/mybeat
    name: mybeat
    rotateeverybytes: 10485760 # = 10MB
  level: info

I have correctly installed input-beat-plugin into logstash server, this is my logstash output conf:

output {
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    index => "logstash-%{tags}-%{+YYYY.MM.dd}"
  }
}

Now the elasticsearch indexes are logstash-mytagbeats_input_codec_plain_applied-2016.06.14
How can manage the tags?

2

I have resolved inserting a filter to logstash:

filter {
    if "beats_input_codec_plain_applied" in [tags] {
        mutate {
            remove_tag => ["beats_input_codec_plain_applied"]
        }
    }
}

Thanks'all

2 Likes
3

This topic was automatically closed after 21 days. New replies are no longer allowed.