How add field using apache module in filebeat

I am using the apache module in filebeat to send logs to elasticsearch. How can I add a field to what gets sent? When I was using type: log I did something like this to get a field added but not sure how to do it when using the apache module:

filebeat.inputs:
- type: log
  paths:
    - /var/log/apache2/access.log*
  fields:
    cluster: 'QA'

I also tried using processor like this but it doesn't seem to work

filebeat.modules:
- module: apache
  access:
    enabled: true
    var.paths: ["/var/log/apache2/access.log*"]
    var.paths: ["/var/log/apache2/other_vhosts_access.log*"]
  error:
    enabled: true
    var.paths: ["/var/log/apache2/error.log*"]
  processor:
    - add_fields:
      fields:
        cluster: 'QA'

I'm trying to get the cluster field to be added to everything that gets sent from this server

I solved this, the processor needed to be at the top-level in the configuration. The processor is applied to all data collected by this Filebeat. For example:

processors:
  - add_fields:
      fields:
        app: 'hosting'
        cluster: 'prd_1'
filebeat.config.modules:
  enabled: true
  path: /etc/filebeat/modules.d/*.yml
filebeat.modules:
- module: apache
  access:
    enabled: true
    var.paths: ["/var/log/apache2/access.log*"]
    var.paths: ["/var/log/apache2/other_vhosts_access.log*"]
  error:
    enabled: true
    var.paths: ["/var/log/apache2/error.log*"]
output.elasticsearch:
  hosts: ['elasticsearch:9200']
  username: 'elastic'
  password: 'password'
setup.kibana:
  host: "kibana:5601"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.