Is there any permanent ID in Filebeat logs?

Elastic Stack Beats
1

Hi,

I'm ingesting filebeat logs (/var/log/filebeat/filebeat-<date>.ndjson) to Elasticsearch so that I can build a dashboard showing the filebeat metrics (e.g. packets received, dropped, etc). Both Filebeat and ES are running version 8.8.0.

I'm running multiple filebeat instances on the same host. I noticed that in the filebeat logs, there isn't any permanent unique ID that would distinguish between different filebeat instances. I only see monitoring.metrics.beat.info.ephemeral_id, which changes every time I restart a filebeat instance, which means I have to modify my dashboard each time I restart a filebeat instance.

I have set filebeat.inputs.id (for type: filestream, which is the inputs for the filebeat logs), and also name, which shows up in my other records as agent.name, but they don't seem to be included in the filebeat logs.

Is there any permanent ID I can use for each filebeat instance?

Thank you.

2

@hjazz6, You can use add_fields processor. Define unique identification for each inputs.

I am also curious why you're using multiple instances on one host where as one instance of filebeat is capable to capture all logs?