I am trying to access an filebeat field in the logstash output. For some reason this is not working. Can someone help on this please?
Filebeat & logstash versions:
filebeat-6.4.1-1.x86_64
logstash-6.3.2-1.noarch
filebeat config:
- /var/log/nginx/access.log
fields:
type: access_log
test: testfield
tenant_id: XXXXXXXXXXXX
api_key: XXXXXXXXXXX
fields_under_root: true
lmm config:
input
{
beats
{
port => 5044
}
}
filter
{
if [type] == "cdg_access_log"
{
mutate
{
add_field => {
"tenant_id" => "%{[fields][tenant_id]}"
"api_key" => "%{[fields][api_key]}"
}
}
}
output
{
http
{
url => "XXXXXXX"
http_method => "post"
format => "json_batch"
headers => ["Content-Type", "application/json"]
headers => ["tenantid", "%{[fields][tenant_id]}"]
headers => ["apikey", "%{[fields][api_key]}"]
}
}
output event:
{:url=>"http://xxxxxxx", :method=>:post, :body=>"[{"@timestamp":"2018-12-04T10:17:30.306Z","type":"access_log","message":"55.255.0:80] [0] [60.048]\\n","@version":"1","tags":["aggregate"]}]", :headers=>{"Content-Type"=>"application/json", "tenantid"=>"%{[fields][tenant_id]}", "apikey"=>"%{[fields][api_key]}"}}