Metricbeat: configure (or reset) host.id

Elastic Stack Beats
,
1

We are using metricbeat to monitor logstash.

We have many logstash vm's that are sending the same host.id in their metricbeat data. I'm guessing this is related to the vm's being cloned from the same template.

How can I either manually change or reset the host.id field that is populated by metricbeat data.

2

Could someone point me in the right direction in the metricbeat code where I could determine what host.id is calculated from?

3

@BradVido Looks like this can be done by adding an add_fields processor to your metricbeat.yml config like this:

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~
  - add_fields:
      target: host
      fields:
       id: 'whatever-id-you-want'

Also you can read more about this in the docs: Add fields | Metricbeat Reference [7.13] | Elastic

4

@simianhacker thanks for the tip. That did work!

But I now realize that the actual field I need to update is the logstash_stats.logstash.uuid field, which is the same across two of my instances.

I found the solution here for anyone else with this problem Logstash Monitoring API - - #2 by chrisronline

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.