Script Processor

[Rithesh_Subramanian]

Hi,
I am trying to add script processor after splitting the message with dissect processor.
But i am not able to start the filebeat after adding the script processor.

processors:
 - rename:
      fields:
        - from: "message"
          to: "data"
 - dissect:
     tokenizer: "TID: [%{ts}] %{lvl} %{TEST} [%{mesID}] {%{class}} [%{message}]"
     field: "data"
     target_prefix: ""

 - drop_fields:
            fields: ["data","class"]

 - script:
    lang: javascript
    id: my_filter
    source: >
                    function process(event) {
                    event.Tag("js");
            }

and I am getting the following error while starting the filebeat.

Exiting: error loading config file: yaml: line 37: did not find expected key

line 37 in my config file points to

event.Tag("js");

Thanks in advance

[ChrsMark (Chris Mark)]

Hi!

Looks like YAML issues:

1. processors key is missing from your config.
2. indentation is not correct.

Here a valid yaml you could use:

filebeat.yml:
filebeat.config:
  prospectors:
    # Mounted `filebeat-prospectors` configmap:
    path: ${path.config}/prospectors.d/*.yml
    # Reload prospectors configs as they change:
    reload.enabled: false
  modules:
    path: ${path.config}/modules.d/*.yml
    # Reload module configs as they change:
    reload.enabled: false
  filebeat.autodiscover:
    providers:
     - type: docker
       templates:
         - condition:
             equals:
               docker.container.labels.io.kubernetes.container.name: "nginx-ingress-controller"
           config:
             - module: nginx
               access:
                 input:
                   type: docker
                   containers.stream: stdoutprocessors:
  processors:
     - rename:
          fields:
            - from: "message"
              to: "data"
     - dissect:
         tokenizer: "TID: [%{ts}] %{lvl} %{TEST} [%{mesID}] {%{class}} [%{message}]"
         field: "data"
         target_prefix: ""
    
     - drop_fields:
                fields: ["data","class"]
    
     - script:
        lang: javascript
        id: my_filter
        source: >
            function process(event) {
                event.Tag("js");
            }