I have installed Filebeat on my servers to collect json logs. It works great !
I have one question : I would like to know if it's possible to modify the content of a message ?
Let me be more explicit :
In Kiban, there is the source filed, which comes from my filebeat configuration :
filebeat.prospectors: - paths: "/appl/wasbivh1/*/data/log/json.log" input_type: log json.keys_under_root: true
So, in Kibana, I have a filed name "source" which prints the path , ie here /appl/wasbivh1/SERVICE/data/log/json.log
What I would like is to be able not to print all the path, but only SERVICE in my kibana.
So the "source" field would print only "SERVICE" (and not all path) in Kibana.
Is there a prospector which could do the job ?
Thanks in advance !