How to filter on execbeat exec.dtdout in logstash?

(Mathias) #1


Trying execbeat is see that data is imported to logstash as exec.command, exec.stdout and exec.exitCode.

I wonder how I can add tags in logstash for further analysis.
In this example I would like to extract the number of lost packets.

Here is an example of data:

  "_index": "execbeat-2018.07.01",
  "_type": "doc",
  "_id": "poFvVWQBovG87emp9BnL",
  "_version": 1,
  "_score": null,
  "_source": {
    "host": "abc123",
    "@version": "1",
    "beat": {
      "name": "abc123",
      "version": "3.3.0",
      "hostname": "abc123"
    "exec": {
      "exitCode": 0,
      "stdout": "PING ( 56(84) bytes of data.\n\n--- ping statistics ---\n1 packets transmitted, 1 received, 0% packet loss, time 0ms\nrtt min/avg/max/mdev = 3.795/3.795/3.795/0.000 ms\n",
      "command": "ping"
    "tags": [
    "type": "execbeat",
    "@timestamp": "2018-07-01T10:42:37.000Z"
  "fields": {
    "@timestamp": [
  "sort": [

First, I tried this:

		grok {
			match => { "exec.stdout" => "(?<packet_loss>\d+)% packet loss" }

That did not work.
Then I tried mutate filter:

	mutate {
		copy => { "exec.stdout" => "experiment" }

That did not work either. No experiment field is created.

Can you give an advice how to use execbeat output together with logstash?

Thanks Mathias

(Magnus B├Ąck) #2

Nested fields are accessed with the [field][subfield] notation.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.