Multiple processors with same name - add_tags

Elastic Stack Beats
1

Hello,
is it possible to create configuration with multiple processors, using same processor name, but different conditions?

I`d like to add tags for specific log files, like all *.log files must be tagged as "log" but all *.out files, as "out", same time - access.log I would like to tagg as "access".

Tried to add multiple processors in filebeat.yml:

processors:
- add_tags:
   when:
      contains:
         log.file.path: ".log"
   tags: ["log"]

processors:
- add_tags:
   when:
      contains:
         log.file.path: ".out"
   tags: ["out"]

processors:
- add_tags:
   when:
      contains:
         log.file.path: "access.log"
   tags: ["access"]

Unfortunately, looks like only last processor works.

Is it possible to add more than one add_tags processor in global config?

2

Hi,

Processors is a list, just list them all in the order you desire them to be executed.
https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html#defining-processors

3

Thank you,
I realized that my config is incorrect, based on docs, it must be

processors:
- add_tags:
   when:
      contains:
         log.file.path: ".log"
   tags: ["log"]
- add_tags:
   when:
      contains:
         log.file.path: ".out"
   tags: ["out"]
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.