How to write processors?

Elastic Stack Beats
1

Hi,

I recently wrote a new beat for serial data, called serialbeat. Now I want to add a processor to this beat, which does a few things with the data before sending it somewhere. Is there any documentation on how to write a processor? If not, do you have any other resources or info you can give me for doing that?

Thank you!

2

Hi @benben,

I don't think we have any documentation on that, perhaps you can get some inspiration from a simple one, like add_locale. Don't forget to register it here: https://github.com/elastic/beats/blob/7fbd75db9620eb102e790f0d32fee3a7765ae6d0/libbeat/cmd/instance/beat.go#L49

3

Hi @exekias, thanks for the info. That should be enough for a start. Is there a way to have a processor only in the repository of a beat or do I need to fork and update the whole beats lib and then update my beat with this custom version. Thinking of something like a beat-scoped processor.

4

You can register the plugin using the empty import in your own beats main.go file. No need to fork beats.

Given your processing is specialised, why you need to introduce a new processor type?

5

Thanks for you answer. I want to process serial data and send it directly to ES without having to run a logstash inbetween.

6

Right. I just wonder why you need to introduce a configurable process, instead of having the data collector do the required processing.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.