Port name lookup for Memcache packetbeat

Elastic Stack Beats
1

Hi,

I use packetbeat to monitor our memcache instances. I have two linux boxes running multiple instances of memcache. For example I have the following instances defined like this.
Port = 11211 == App1
11212 == App2
11213 == App3

I would like to figure out the best way to add the App1, App2 and App3 name to the event. In my environment I'm running 5.1.2 and my Packetbeat sends directly into ingest nodes.

Can I modify a pipeline on the ingest node to add this App name?

Thanks,
Tim

2

I think https://www.elastic.co/guide/en/beats/packetbeat/current/using-environ-vars.html would probably be what you are after.

3

Unfortunately in packetbeat one can not configure a protocol analyzer of the same type multiple times (e.g. filebeat/metricbeat allows defining the same module type multiple times + support to configure additional metadata).

In your case I think I would add a field via ingest pipeline.