If statment not working event.dataset

Hay all

I am treying with logstash to add an tag where ever filebeats pass an nignx.access

   if [event.dataset] == "nginx.access" {
        mutate { add_tag => [ "nginx" ] }


But for some reason they are not being picked up, all other ones i am trying where the feild does not have an "." In it.

What am i missing??

OMG :frowning: just after asking this, my next google search found the answer :frowning:

[event.dataset] is showen in logstash as [event][dataset]

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.