Pipeline Filtering - Add Tags Help


I'm attempting to create custom tags on individual hosts by editing the logstash pipeline.

I have attempted to use this:

      if [agent][hostname] == "Host100"{
            mutate {
               add_tag => [ "AD" ]

Not quite sure what may be wrong with the syntax here. When we threw this into the pipeline to test, the beats for that host stopped appearing in discover. So it seems they were blocked out. (Everything else continued reporting)

If anyone has familiarity with adding tags for the sake of organization of a hosts beats, your help would be greatly appreciated.



This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.