Mutate beats field

Elastic Stack Logstash
1

I cannot seem to get this to work:

mutate { add_field => { "hostname" => "%{beat.hostname}" } }

I used this template of code quite a bit and it is working just fine for other items.

2

I end up with this, visible from Kibana:

t hostname %{BEAT.HOSTNAME}

3

You're using the wrong notation for nested fields.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references

4

Ohhh, so:

%{[beat].[hostname]} ?

5

No, %{[beat][hostname]}.

6

Ah....muchas gracias!

7

In terms of things like packetbeat and winlogbeat, is there an easy way to change the field names?

I want get some of them in line with other fields names created from my groks.

8

I can see in new logs coming in, that worked. Thank you very much sir.

9

In terms of things like packetbeat and winlogbeat, is there an easy way to change the field names?

I doubt you can change the field names being sent from those tools but you can certainly use Logstash to rename them.

10

Yea true. Didn't want to add any undue cycles unless I needed to.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.