# How to filter on execbeat exec.dtdout in logstash?

**URL:** <https://discuss.elastic.co/t/how-to-filter-on-execbeat-exec-dtdout-in-logstash/138079>\
**Category:** Logstash\
**Created:** [July 1, 2018, 10:48am UTC](https://discuss.elastic.co/t/how-to-filter-on-execbeat-exec-dtdout-in-logstash/138079 "2018-07-01T10:48:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mathias/32/23176_2.png) [@mathias](https://discuss.elastic.co/u/mathias)\
**Post date:** [July 1, 2018, 10:48am UTC](https://discuss.elastic.co/t/how-to-filter-on-execbeat-exec-dtdout-in-logstash/138079/1 "2018-07-01T10:48:39Z")

</div>

Hi,

Trying execbeat is see that data is imported to logstash as exec.command, exec.stdout and exec.exitCode.

I wonder how I can add tags in logstash for further analysis.  
In this example I would like to extract the number of lost packets.

Here is an example of data:

> ```
> {
> "_index": "execbeat-2018.07.01",
> "_type": "doc",
> "_id": "poFvVWQBovG87emp9BnL",
> "_version": 1,
> "_score": null,
> "_source": {
> "host": "abc123",
> "@version": "1",
> "beat": {
> "name": "abc123",
> "version": "3.3.0",
> "hostname": "abc123"
> },
> "exec": {
> "exitCode": 0,
> "stdout": "PING google.com (216.58.209.142) 56(84) bytes of data.\n\n--- google.com ping statistics ---\n1 packets transmitted, 1 received, 0% packet loss, time 0ms\nrtt min/avg/max/mdev = 3.795/3.795/3.795/0.000 ms\n",
> "command": "ping"
> },
> "tags": [
> "beats_input_raw_event",
> "_grokparsefailure"
> ],
> "type": "execbeat",
> "@timestamp": "2018-07-01T10:42:37.000Z"
> },
> "fields": {
> "@timestamp": [
> "2018-07-01T10:42:37.000Z"
> ]
> },
> "sort": [
> 1530441757000
> ]
> }
> 
> ```

First, I tried this:

> ```
> grok {
> match => { "exec.stdout" => "(?<packet_loss>\d+)% packet loss" }
> }
> 
> ```

That did not work.  
Then I tried mutate filter:

```
	mutate {
		copy => { "exec.stdout" => "experiment" }
	}

```

That did not work either. No experiment field is created.

Can you give an advice how to use execbeat output together with logstash?

Thanks Mathias

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 2, 2018, 7:11am UTC](https://discuss.elastic.co/t/how-to-filter-on-execbeat-exec-dtdout-in-logstash/138079/2 "2018-07-02T07:11:20Z")

</div>

Nested fields are accessed with the `[field][subfield]` notation.

[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2018, 7:11am UTC](https://discuss.elastic.co/t/how-to-filter-on-execbeat-exec-dtdout-in-logstash/138079/3 "2018-07-30T07:11:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.