New module - fields.yml and filebeat.template.json

(Edi Šuc) #1


I'm creating a new module to parse proftpd's xferlog log file. I got the parsing ok, but I'm stuck with Elastic Search mappings. I realized, that the mappings are done by uploading the template file filebeat.template.json (I'm using a Debian package) which is automatically done by filebeat.

I created the fileds.yml for the module, but I can't figure out, how to get it inside the filebeat.template.json. Is there an automatic generator for this or do I have to manually change filebeat.template.json?


(Noémi Ványi) #2


Generated files are produced when running make update. However, it is not available when you try to extend the installed deb package.
In order to create a new module to Filebeat, you have to clone the Beats repository. There is a guide on how to create Filebeat modules:

(Edi Šuc) #3


Thank you for the pointer. I was following the guide you suggested just didn't find out that I had to run make update.
And another cardinal mistake on my part: I was working on the version 7.0.0-alpha1 instead of 5.5.1.

Thank you again. Everything is working now.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.