I have several log type inputs in Filebeat, these specify one or more extra fields.
E.g. a.yml for logs from app 'A', b.yml for logs from app 'B'. The extra field 'index' is set to 'index_A' and index_B' respectively.
Logs are sent to a Logstash output where based on the field they end up in different Elasticsearch indices.
Now, I've just enabled the elasticsearch module on a test Elasticsearch node, but I cannot find a way to specify extra fields for logs harvested by this module.
Is there a way for this? I need to be able to separate logs on the Filebeat level, so when it arrives to Logstash it already has an index field.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.