How does the dynamic typing work in filebeat

(Jason) #1

We are looking to send a plethora of different logs into a downstream logstash cluster.

How exactly does the type setting work within filebeat, so that I can appropriately tag incoming data in logstash in order to grok the info properly [for parsing]?

The template file shows "type": "{dynamic_type}", but I can't find an explanation of what that means.

Is there a best practice for being able to easily add a type on the logstash side (via the beats input) so that I can easily direct to filter to the right grok?

(Andrew Kroh) #2

You can override the type field using Filebeat config by using document_type. By default the value is "log".

The template file is for the Elasticsearch index template. You can read more about the format here. Most users have no need to modify this.

I think what you are asking is how can you add additional data to the events so that you can setup conditional processing in Logstash. For this you have multiple options.

(system) #3