How do I add AWS metadata to Filebeat?

Elastic Stack Beats
1

I want to include AWS Instance's tag information in each Filebeat document. I can think of two ways to do this -

  1. Modify the log output and include the info in there. This will require tweaking all the services whose log files are being tracked.
  2. Run a script at launch that
  • modifies the filebeat.yml file
  • pulls AWS metadata for that instance
  • and adds the tag info to yml file

It sounds like method 2 is the right approach.
Is there a better way to do this? Does Filebeat provide a way to dynamically set prospector attributes?

2

You can also use environment variables. See here for more infos.

3

You just need to add this to your config file if you want instance_id. For other information you could use environment variables.

processors:
- add_cloud_metadata:

See the add_cloud_metadata documentation for more details.

4

Thanks. This helps.