Read Optional fields

Elastic Stack Logstash
1

We have installed File-Beats on multiple servers to harvest JBoss logs and save through the same Log-Stash pipeline into Elastic-Search. We have set the optional fields in File-Beats config and want to save the Channel and Node into their own Elastic-Search field.

File-Beats config line 95 - 98:

Optional fields that you can specify to add additional information to the

output.

#fields:
channel: QA
node: 1

Log-Stash config
filter {
grok {
match => [
"message",
"%{CHANNEL:channel} %{NODE:node} %{TIME:time} %{LOGLEVEL:level} [(?[^]]+)] ((?[^)]+)) %{GREEDYDATA:message}"
]
overwrite => ["message"]
}
}

2
  • Don't comment the fields: line.
  • It doesn't seem to make sense to both save the fields via the Filebeat configuration and extract the same fields in the grok filter. Pick one method of obtaining those field values.