Hay all
I am treying with logstash to add an tag where ever filebeats pass an nignx.access
if [event.dataset] == "nginx.access" { mutate { add_tag => [ "nginx" ] } }
But for some reason they are not being picked up, all other ones i am trying where the feild does not have an "." In it.
What am i missing??
OMG just after asking this, my next google search found the answer
[event.dataset] is showen in logstash as [event][dataset]
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.