Running external scripts from filebeat

[vitaly_r (Vitaly)]

Hello,

We are moving from Logstash to filebeat in our network. Everything went smoothly except one thing.
We have use case when external (quite complicated) script shall be called in order to enrich the event sent to ES.

We have used an exec filter with Logstash as described here: http://vrepin.org/vr/Logstash-filter-external-script/

It looks like the most natural place to have similar functionality in filebeat is processor. But I was not able to find any processor which can launch external script and get its results (stdin/stderr) in return.

What is the easiest way to do this in filebeat? Any ideas are welcome. I am ready to develop a patch for filebeat but I want to understand what is the best and easiest way to get this functionality on board.

Thanks in advance!

[exekias (Carlos Pérez Aradros)]

Hi @vitaly_r,

Filebeat doesn't have exec capabilities. Probably the easiest way is run the script and dump the result to a local file, then make filebeat fetch it as a common log.

Best regards