Set beat.name/any custom field based on source

[manojvenkat (Manoj)]

Hi ,

Is it possible to set the beat.name using if condition based on source field value.

Eg. if source: /user1/logs, then beat.name=USER1_LOGS
else if source:/user2/logs, then beat.name=USER2_LOGS

I need this to differentiate for creating vizualizaton graphs

If not beat.name, any other fields also fine.

Thanks.

[manojvenkat (Manoj)]

Hi ,

Could someone please respond.

Thanks,

[andrewkroh]

@manojvenkat

Is it possible to set the beat.name using if condition based on source field value.

No.

@manojvenkat

Hi ,

Could someone please respond.

Thanks,

Elastic offers support subscriptions with guaranteed response times if this is something you need.

@manojvenkat

I need this to differentiate for creating vizualizaton graphs

If not beat.name, any other fields also fine.

The source is populated with the full path of the log file. That might be an option to differentiate things based on your use case.

Another option would be separate the user1 and user2 logs into their own prospectors and assign each of them a custom field.

filebeat.prospectors:
- paths: [/user1/logs/*.log]
  fields_under_root: true
  fields: {user: user1}
- paths: [/user2/logs/*.log]
  fields_under_root: true
  fields: {user: user2}

[manojvenkat (Manoj)]

Thanks a lot Andrew. I will try out and update the result here.

[manojvenkat (Manoj)]

Hi,

I am not able to make this for Filebeat 1.3 . Could you please suggest compatible solution for version 1.3.

[andrewkroh]

For 1.3,

filebeat:
  prospectors:
  - paths: [/user1/logs/*.log]
    fields_under_root: true
    fields: {user: user1}
  - paths: [/user2/logs/*.log]
    fields_under_root: true
    fields: {user: user2}