Hello, I would like to ask a question about Custom Fields. I had just added a "Custom Field" inside one of my Fleet Policy, as shown on the below screenshot: [Screenshot 2024-10-25 162902] I get the field correctly added to all the logs (and therefore transposed to all the alerts) that are gener…

The Fleet settings apply to a feature called "processors" which only Beats have. Endpoint doesn't have support for it, but it also has a means to inject simple key-value pairs into documents, see advanced option [platform].advanced.document_enrichment.fields [image]

Missing "Custom Fields" in alerts generated from "endpoint" indexes

Elastic Security

ferullo (Daniel Ferullo) October 29, 2024, 2:43pm 4

I haven't tested this, but if you add these custom fields to index mappings does that fix it?

Topic		Replies	Views
Custom fields are empty Beats	13	3443	August 11, 2017
Adding a custom field in alerts without defining in query Elastic Security detection-rules	13	3767	November 4, 2022
Indexing on customized fields Elasticsearch	2	312	July 6, 2017
How to add custom fields with eventlog on winlogbeat Beats winlogbeat	2	2880	May 23, 2016
Fleet Custom Logs integration add_fields processor Beats fleet	12	1448	October 25, 2022

Missing "Custom Fields" in alerts generated from "endpoint" indexes

Related topics