Read Optional fields


#1

We have installed File-Beats on multiple servers to harvest JBoss logs and save through the same Log-Stash pipeline into Elastic-Search. We have set the optional fields in File-Beats config and want to save the Channel and Node into their own Elastic-Search field.

File-Beats config line 95 - 98:

Optional fields that you can specify to add additional information to the

output.

#fields:
channel: QA
node: 1

Log-Stash config
filter {
grok {
match => [
"message",
"%{CHANNEL:channel} %{NODE:node} %{TIME:time} %{LOGLEVEL:level} [(?[^]]+)] ((?[^)]+)) %{GREEDYDATA:message}"
]
overwrite => ["message"]
}
}


(Magnus B├Ąck) #2
  • Don't comment the fields: line.
  • It doesn't seem to make sense to both save the fields via the Filebeat configuration and extract the same fields in the grok filter. Pick one method of obtaining those field values.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.