How to use "exported fields"?

Elastic Stack Beats
1

Helo, please help. From documentation and googling i can't understand what "Exported fields" in filebeat is and how to use them. For example i want to add information about logfile's mtime when i send events to logstash.

One of my tries

filebeat.inputs:
- type: log
  paths:
    - /test.log
processors:
- add_fields:
     fields:
       mtime: "%{file.mtime}"

output.logstash:
  hosts: ["logstash.ip:5044"]

but logstash recieved this:

{
.....
         "input" => {
        "type" => "log"
    },  
        "fields" => {
        "mtime" => "%{file.mtime}"
    },
           "log" => {
          "file" => {
            "path" => "/test.log"
        },
....
}

and i want something like this

    {
    .....
             "input" => {
            "type" => "log"
        },  
            "fields" => {
            "mtime" => "2019-07-26 19:23:21"
        },
               "log" => {
              "file" => {
                "path" => "/test.log"
            },
    ....
    }

Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.