How to filter Filebeat output by input id?

[paolovalladolid]

I configured filebeat.yml as follows:

filebeat.inputs:
- type: filestream
  id: my-input1
  paths:
    - /opt/mything1/logs/*.log

- type: filestream
  id: my-input2
  paths:
    - /opt/mything2/logs/*.log

- type: filestream
  id: my-input3
  paths:
    - /opt/mything3/logs/*.log

But when I look at the data in Kibana Discover, I cannot figure out how to filter by id. For example I want to see data only from the my-input2 ID. But Discover gives me no way to do it from what I can tell.

[stephenb (Stephen Brown)]

Hi @paolovalladolid

The input ID is internal to filebeat and is not exported as part of the data set.

But you can simply add a tag or a field as you like to each of those inputs and then filter on them

[paolovalladolid]

I added a fields as follows:

filebeat.inputs:
- type: filestream
  id: my-input1
  fields: 
    app_id: my-input1
  paths:
    - /opt/mything1/logs/*.log

but Discover is not letting me use app_id as a filter.

I'll try adding a tags option instead.

[stephenb (Stephen Brown)]

Works for me...
What version?
Did you refresh the Discover Page? or what ever page you are on? Sometime the Data view needs to be refreshed.
Are you using the Default Template?
Are you using a different index name / data stream?

You did not provide much for me to go on, what filter is that?

# filestream is an input for collecting log messages from files.
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - /var/log/*.log
  fields: 
    my-app-id: "app-1"  

[paolovalladolid]

Sorry about the missing details. We're on 7.17.0

Refreshing the Discover page in Kibana fixed my issue. I am now able to filter by fields.app_id as expected.

Thanks!