Tagging events with extracts from grok patterns

Hi all,

I am using Filebeat to pass logs to Logstash for parsing and ingestion into Elasticsearch. Take this config extract for example:

- type: filestream
  - /opt/containers/sites/*/html/var/log/system.log
  - /opt/containers/sites/*/html/var/log/debug.log
  - /opt/containers/sites/*/html/var/log/exception.log

  tags: ["magento"]

As you can see, I am grabbing all of my Magento logs. The problem arises when I want to filter logs by site in Kibana. At this point I can't see a very obvious or easy way to do this. I thought it would be great if I could add tags depending on what grok finds, e.g. grok finds a file at


and tags events with magento-examplemagentostore. I am trying to avoid hard coding the sites into Filebeat's config as that wouldn't be very dynamic with adding more sites.

Any thoughts or resources are appreciated.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.