Recommended way of telling Logstash type of logs

Elastic Stack Beats
1

In Filebeat 6 the document_type field was removed. However, all of the examples that I can find for parsing logs with Logstash rely on the type field being set (which was determined by the document_type setting on the Filebeat prospector. For example, [SOLVED] Filebeat to Logstash best practice show does this:

filter {
  if [type] == "nginx-access" {
    # ...
  }
}

Some other resources (such as Document_type deprecated?) suggest add a custom field to the fields configuration on the Filebeat prospector, but this seems a little bit incovenient because it means that either I have to use [fields][type] in my Logstash configuration (which is fine I guess, but [type] felt much cleaner) or I need to remember to set fields_under_root on all of the Filebeat prospectors.

2

There is no direct replacement for document_type. With removal of document_type you have to use fields + fields_under_root or use tge tags settting. Using tags you condition in Logstash becomes:

filter {
  if "nginx-access" in [tags] {
  }
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.