Prospector "fields" values being overwritten

Elastic Stack Beats
1

Hi,

We have a Filebeat config that has two prospectors. Both prospectors define their own tags and "fields" values. However, the fields values of the first prospector are being overwritten by the values of the second prospector. Here is the config:

filebeat.prospectors:
- type: log
  enabled: true
  paths: ["C:/path1"]
  fields:
    sw: SW_name_1
  include_lines: ['ERROR', 'WARN']
  multiline.pattern: ^([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3} - )
  multiline.negate: true
  multiline.match: after
  tags: ["tag1"]
- type: log
  enabled: true
  paths: ["C:/path2"]
  fields:
    sw: SW_name_2
  include_lines: ['\AERROR', '\AWARN']
  multiline.pattern: ^(TID)
  multiline.negate: true
  multiline.match: after
  tags: ["tag2"]

So in KIbana we can only see "fields.sw:SW_name_2", even when the source is "C:/path1" and the tags contain "tag1". This has led us to believe that the "fields.sw" value is being overwritten somehow.

We then tried removing the
fields:
sw: SW_name_2
section. Then the "SW_name_1" value appeared in new entries as expected.

Any idea what might be the cause?
Thank you!

2

What Filebeat version are you using?

3

filebeat 6.0.0

4

Could you try version 6.1.3. I vaguely recall there being an issue with fields that was fixed.

5

Thank you for the tip. The update to 6.1.3 seems to have fixed the issue :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.