New module - fields.yml and filebeat.template.json

Elastic Stack Beats
1

Hi.

I'm creating a new module to parse proftpd's xferlog log file. I got the parsing ok, but I'm stuck with Elastic Search mappings. I realized, that the mappings are done by uploading the template file filebeat.template.json (I'm using a Debian package) which is automatically done by filebeat.

I created the fileds.yml for the module, but I can't figure out, how to get it inside the filebeat.template.json. Is there an automatic generator for this or do I have to manually change filebeat.template.json?

Thanx,
Edi

2

Hi,

Generated files are produced when running make update. However, it is not available when you try to extend the installed deb package.
In order to create a new module to Filebeat, you have to clone the Beats repository. There is a guide on how to create Filebeat modules: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-devguide.html

2 Likes
3

Hi.

Thank you for the pointer. I was following the guide you suggested just didn't find out that I had to run make update.
And another cardinal mistake on my part: I was working on the version 7.0.0-alpha1 instead of 5.5.1.

Thank you again. Everything is working now.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.