I created a post yesterday and i can't find it, so i hope this isn't flag as repost. I wanted to know if there was a way for filebeat to send specific metada from the node because right now i am getting a nod id for each event which is a random long id created by docker and the hostname that is sending is the container id, what i want is the node name so i can easily identify which node is being used. Is it posible? Can i force the creation of a field with that information?
Hi!
There is a processor called add_docker_metadata:
https://www.elastic.co/guide/en/beats/filebeat/current/add-docker-metadata.html
Hope this is what you're looking for! 
I tried that, but i am still seeing the docker node id (something like yrkr4jyjlru1kkdw9z8wycj7i) and the hostname is still the id of the container (c07a4fb87b78). Is there another thing that i could try? Can filebeat get the hostname of the node?
Well, not natively as of today, because the container doesn't get this info from the server. One thing you could do is passing the hostname when you run the container. However this is a rather static method of solving this problem.
Description here: https://stackoverflow.com/questions/23609195/get-hostname-in-logstash-running-in-a-docker-container
Hope this helps!
Is not exatly what i need and as you said is a static method which has it issues. I will try to make a change at a Kibana or Logstash level, maybe i can update/change an specific value in a specific field to another value. Since my nodes are not like to change much during the next months, this shouldn't be much of a issue right now. At least i know that is mostly due to the API and not because i was missing some feature. I'll make some test this week and try to come back and update you guys/girls in case someone else needs a similar thing.
1 Like
I made some more digging, and i can do what i need in the logstash pipeline via logstash plugins. Unfortunally i couldn't make it work yet but i am sure that i am missing something. I will create a new post in the logstash forum and see i can correct my configuration.
Thanks for the help
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.