How to setup tags?


(Marcus Neumann) #1

Hi all,

i'm trying to configure logstash-forwarder to send a tag with every event, but it fails:
I've tried:
"fields": { "type": "eslog" },
"tags": [ "esnode1" ]

But this seems to be ignored...
If i add it as field e.g. "fields": { "type": "eslog", tags: "esnode1" } it becomes a string, so adding other tags in filter section results in "tags":"esnode1_grokparsefailure..."
If i define it as an array in fields, LSF complains "json: cannot unmarshal array into Go value of type string"

Any hint?

Regards,
Marcus


(Magnus B├Ąck) #2

The LSF configuration doesn't support a tags field so the only way to pass a (singular) tag is via fields.

If i define it as an array in fields, LSF complains "json: cannot unmarshal array into Go value of type string"

Yes, fields set in LSF need to be strings. I don't know why, really. Seems like an unnecessary limitation. LSF is being deprecated in favor of filebeat and filebeat has the same limitation. I've filed github.com/elastic/filebeat/issue #69 for this.


(ruflin) #3

@mne @magnusbaeck Lets continue the discussion directly in the open Github issue: https://github.com/elastic/filebeat/issues/69


(system) #4