I want to add a new field based on the content of the source field from filebeat. The filebeat-* index shows SOME logs get the new field, and other logs are empty. However, the logstash-* index has file defined for every log file. Don't understand.
Thank you, magnus. Could I get you to look at my latest config? I made my jboss filebeat send the type as "jboss" so I could do some processing on it. I want to extract the debug level. Again, some logs I see the level field added and some I don't, yet the message exists and my pattern matches as confirmed in the grok debugger.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.