Logstash agent.* fields

Elastic Stack Logstash
1

Is it possible to configure logstash to populate agent.* fields in the same way beats agents do this e.g.

agent.type
agent.version
...

Many thanks

2

I don't believe there is an option in logstash to do that automatically.
Which leaves you with the option to add a filter section in your pipelines(s) to do this using a mutate for example.

3

You have to add manually. There are similar fields, it depends on the input plugin, LS can add "host", "log"...

4

Hi,

You can use the add_field option in your Logstash filter or output plugins to add these fields to your events.

Here is an example of how you can do this in a Logstash filter:

filter {
  mutate {
    add_field => { 
      "[agent][type]" => "logstash"
      "[agent][version]" => "7.17.0"
    }
  }
}

Mutate filter plugin | Logstash Reference [8.11] | Elastic

Regards

1 Like
5

Thank you for the reply - can anyone confirm if there a way to configure logstash to output these automatically in the same way beats does? Or is this not possible and the only solution is to use add_field and populate them myself ..

6

This is not possible because the agent fields are related to Elastic Agent/Beats, logstash is not an agent, so those fields will not be generated by Logstash.

The only way would be to create them using the mutate filter.

But, what you are trying to achieve with that? Can you provide more context?

7

Thanks I will populate the fields using the method suggested here

The reason for the question was just to be able to see the source of logs - the agent, version, and host it is running on in the same way I can with beats.

Mainly the host logstatsh is running on as I am populating host.name with a value from the log line

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.