How to make input processor process all data?

Elastic Stack Beats
1

In my application, there are multiple logs that need to process, I want every log has its own processors.
BUT processors under specific input only process data collected by this input;

- type: log
  paths:
    - ./data.log
  fields_under_root: true
  fields:
    '@log_type': data
    namespace: data
    net_pub: 1
  json.keys_under_root: true
  json.overwrite_keys: true
  json.add_error_key: false
  processors:
    - copy_fields:
        fields:
          - from: host.name
            to: srv_host
          - from: dur
            to: mydur-data
        fail_on_error: false
        ignore_missing: true
    - drop_fields:
        fields: ["agent","host","log","ecs"]

how to make it also process all data collected by Filebeat?

2

Not sure if I understand your problem. You define processors globally, so they can process all data (top-level processors): https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html#where-valid

3

yes, top-level processors can work. but in my scenario, every input must have its own processor list which totally diffent. so I cant use a top-level processor ;

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.