How tcp input add fields?

Elastic Stack Logstash
1

I use python tail log file, and publish to logstash(tcp input).

Because my system problem(#46708), I can't use filebeat, and filebeat have a very useful setting fields.

How can I achieve this features by python.

2

You would either need to use the add_fields option in the input, or use grok.

3

I suggest that you instead of sending the raw log file contents construct JSON strings containing whatever fields you like (including one field with the log message) and send that to Logstash. Use a json (or json_lines?) codec to deserialize the JSON string.

4

Yes, you are right. Thank for your suggest.