How to extract custom field value from first line and add it into later lines with Filebeat

Elastic Stack Beats
1

I am using filebeat to import log file which has some meta data in the first few lines into ELK.

The log file format looks like this:

Hostname: xxx
Created: <time>
Format: XXX
----Actual logs---

I want to extract the hostname information from the first line and add it as a custom field to all actual log lines.
The reason is that I have many files from different hosts (but not from their original server, instead they are all placed in the same jumphost).
Is this possible with filebeat/ELK? If so how can this be done?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.