Non-registered extract_field processor

Elastic Stack Beats
1

I just discovered the extract_field processor, which can be used e.g. to extract application instance IDs from log file paths. It might just need some documentation.

However, it is not registered. This one won't be registered (yet)
Is there a reason for that? @exekias

2

Hi @MasterCarl,

Could you explain a little bit why do you want it and how do you plan to use it? Normally we do this kind of processing in the Ingest node or Logstash

3

Hi,

I wanted to extract an instance ID from the path in the exported source field on a host running multiple application instances, e.g. /service/012345/logs/current.log => 012345.
I changed my approach to just running one filebeat instance per application and adding static fields based on individual configuration files. Still, I think that having this processor available for general use might be useful. I chose to do this kind of processing on the beat side to minimize transmission overhead.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.