Rename fieldname in incoming logs

Elastic Stack Elasticsearch
1

Hi All,

we have now two different shippers sending logs to our es cluster (no logstash included).
FileBeat is sending the log-message itself in field "message" and fluentbit (we have limited control over its configuration because its centralized) sends the message in field "log".

Is there a efficient way (on es side) to rename the field "log" in the logs shipped by fluentbit to "message" ?

Thanks all and greetings!

2

I don't know if fluentbit supports using elasticsearch ingest pipelines.
If it does, just create a pipeline with a rename processor.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.