How to set custom fileds via CLI when ingesting with filebeat?

Elastic Stack Beats
1

Hi there,

when running filebeat I'd like to set some custom fields and tags via a CLI parameter.
zcat mylog.gz | filebeat -e config yml -E "tags=['huhu']" -E "fields.app_id=['foo']"

The corresponing bits in config are

filebeat.inputs:
filebeat.inputs:

  • type: stdin
    enabled: true
    ignore_older: 0
    tags: ["dummy"]
    fields:
    app_id: query_engine_12

However, in elastic just the tags are set, but the field is not. Why is that?

Related to that: the docs https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html seem to indicate that I would need to write -E "filebeat.inputs.tags=['huhu']" instead? Why does it work as described above but not when using the full field reference?

Thanks in advance,
Holger

2

I'm unable to reproduce this issue with Filebeat I just built from source (from the master branch). What version of Filebeat are you running?

3

Hey Shaunak,

I'm using the binary release 6.6. What would certainly help is to see some more example that overwrite parameters defined in a filebeat yaml. For instance I'm not even sure if should use -E or -M.

Are you saying that it should work as described above? What would be the correct syntax to set custom field attributes for the filebeat log module via the CLI?

Thanks a lot for your support.

Best,
Holger