when running filebeat I'd like to set some custom fields and tags via a CLI parameter.
zcat mylog.gz | filebeat -e config yml -E "tags=['huhu']" -E "fields.app_id=['foo']"
The corresponing bits in config are
- type: stdin
However, in elastic just the tags are set, but the field is not. Why is that?
Related to that: the docs https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html seem to indicate that I would need to write -E "filebeat.inputs.tags=['huhu']" instead? Why does it work as described above but not when using the full field reference?
Thanks in advance,