Mutate beats field


(Jason Kopacko) #1

I cannot seem to get this to work:

mutate { add_field => { "hostname" => "%{beat.hostname}" } }

I used this template of code quite a bit and it is working just fine for other items.


Mutate beats field isnt working in logstash5.0.2
(Jason Kopacko) #2

I end up with this, visible from Kibana:

t hostname %{BEAT.HOSTNAME}


(Magnus Bäck) #3

You're using the wrong notation for nested fields.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references


(Jason Kopacko) #4

Ohhh, so:

%{[beat].[hostname]} ?


(Magnus Bäck) #5

No, %{[beat][hostname]}.


(Jason Kopacko) #6

Ah....muchas gracias!


(Jason Kopacko) #7

In terms of things like packetbeat and winlogbeat, is there an easy way to change the field names?

I want get some of them in line with other fields names created from my groks.


(Jason Kopacko) #8

I can see in new logs coming in, that worked. Thank you very much sir.


(Magnus Bäck) #9

In terms of things like packetbeat and winlogbeat, is there an easy way to change the field names?

I doubt you can change the field names being sent from those tools but you can certainly use Logstash to rename them.


(Jason Kopacko) #10

Yea true. Didn't want to add any undue cycles unless I needed to.


(system) #11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.