How to setup tags?

Elastic Stack Logstash
1

Hi all,

i'm trying to configure logstash-forwarder to send a tag with every event, but it fails:
I've tried:
"fields": { "type": "eslog" },
"tags": [ "esnode1" ]

But this seems to be ignored...
If i add it as field e.g. "fields": { "type": "eslog", tags: "esnode1" } it becomes a string, so adding other tags in filter section results in "tags":"esnode1_grokparsefailure..."
If i define it as an array in fields, LSF complains "json: cannot unmarshal array into Go value of type string"

Any hint?

Regards,
Marcus

2

The LSF configuration doesn't support a tags field so the only way to pass a (singular) tag is via fields.

If i define it as an array in fields, LSF complains "json: cannot unmarshal array into Go value of type string"

Yes, fields set in LSF need to be strings. I don't know why, really. Seems like an unnecessary limitation. LSF is being deprecated in favor of filebeat and filebeat has the same limitation. I've filed github.com/elastic/filebeat/issue #69 for this.

3

@mne @magnusbaeck Lets continue the discussion directly in the open Github issue: https://github.com/elastic/filebeat/issues/69