The "fields" property only works with the dictionary type

Elastic Stack Beats
1

Hi,

The "fields" property is here to add custom fields to an input.

The doc says:

Fields can be scalar values, arrays, dictionaries, or any nested combination of these.

But if you set a scalar value like this:

fields: "foobar"

Filebeat outputs the following error:

Exiting: Error in initing input: required 'object', but found 'string' in field 'filebeat.inputs.0.fields' (source:'/etc/filebeat/filebeat.yml')

If I set the field using the array, like this:

fields: ["foobar"]

or this:

fields:
  - "foobar"

I've got no error but the field is not in the ouput.

The only way it works is with the dictionary type:

fields:
    foobar: true

Am I missing something or the doc is wrong?

2

The wording used in the docs is a bit misleading. When it says "Fields can be ..." it really means "Fields values can be ...".

So basically it means that for every field you declare, you can assign it a "scalar value, array, dictionary, or any nested combination of these."

fields:
  field_scalar1: "string"
  field_scalar2: 42     
  field_array: [ "hello", "world" ]
  field_dict:
      key1: value1
      key2: value2

The contents of the fields: key itself are always a dictionary

3

Oh, I see.

Thanks for the quick reply!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.