I have created a new module to Filebeat. To be honest I have been struggling with this for a long time, perhaps a blog post somewhere (creating a new filebeat start to finish) I could find could help me immensely. Anyway. I have cloned the beats repository, created a filebeat module, and gone through and tested it. This module has new fields which I need loaded into the template, and here is where I cannot connect the dots. I have run "make update" which updates the fields.yml file at the top level beats/Filebeat dev folder.
How do I get this module into production?
I have and installed filebeat module on Linux, and have replaced the fields.yml from the dev folder (which has the additional fields included in it) into /etc/filebeat folder. I then delete the template on Elastic and start filebeat. It creates the template again, but not with the additional fields I need.
a) How do I get the additional fields loaded into the template
b) Is there a way to have a per module template being built at runtime. My understanding is that if the filebeat module is upgraded, it may overwrite fields.yml and donk my custom fields? Is this true - if so, surely there has to be a better way?
c) What is the method to move from Dev to Prod for a filebeat module