The filebeat dissect processor has a handy "target_prefix" option, which allows everything it extracts to be placed under a common prefix.
Is there any equivalent for the dissect or grok processors in an ingest pipeline, or an easy way to accomplish the same thing for a grok pattern that's made up of a bunch of pattern definitions?
I don't think so, there is nothing in the documentation for the
grok processors on an Ingest pipeline works similar to the same filters on a Logstash pipeline, where also there is no target_prefix to store the fields on a top-level field.
If you need to store it on a top-level field as a prefix you will need to directly add the prefix on the fields names, for example, instead of
fieldName you will need to use
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.