How to set custom fileds via CLI when ingesting with filebeat?

(Holger Brandl) #1

Hi there,

when running filebeat I'd like to set some custom fields and tags via a CLI parameter.
zcat mylog.gz | filebeat -e config yml -E "tags=['huhu']" -E "fields.app_id=['foo']"

The corresponing bits in config are


  • type: stdin
    enabled: true
    ignore_older: 0
    tags: ["dummy"]
    app_id: query_engine_12

However, in elastic just the tags are set, but the field is not. Why is that?

Related to that: the docs seem to indicate that I would need to write -E "filebeat.inputs.tags=['huhu']" instead? Why does it work as described above but not when using the full field reference?

Thanks in advance,

(Shaunak Kashyap) #2

I'm unable to reproduce this issue with Filebeat I just built from source (from the master branch). What version of Filebeat are you running?

(Holger Brandl) #3

Hey Shaunak,

I'm using the binary release 6.6. What would certainly help is to see some more example that overwrite parameters defined in a filebeat yaml. For instance I'm not even sure if should use -E or -M.

Are you saying that it should work as described above? What would be the correct syntax to set custom field attributes for the filebeat log module via the CLI?

Thanks a lot for your support.


(system) closed #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.