Hi.
Im using filebeat to send to Opensearch a preformatted json logfile. The files are parsing fine, but i have an unknown field and i don´t know why:
My log file :
{"data": {"affected_items": [{"cpu": {"cores": 8, "mhz": 2594, "name": "Intel Core Processor (Broadwell, no TSX, IBRS)"}, "ram": {"free": 14336760, "total": 16372160, "usage": 13}, "scan": {"id": 0, "time": "2024-05-09T08:47:30+00:00"}, "board_serial": " ", "agent_id": "058"}], "total_affected_items": 1, "total_failed_items": 0, "failed_items": []}, "message": "All specified syscollector information was returned", "error": 0}
{"data": {"affected_items": [{"cpu": {"cores": 8, "mhz": 2694, "name": "Intel(R) Xeon(R) Gold 6258R CPU @ 2.70GHz"}, "ram": {"free": 8709676, "total": 16362568, "usage": 47}, "scan": {"id": 0, "time": "2024-05-09T09:06:25+00:00"}, "board_serial": "None", "agent_id": "082"}], "total_affected_items": 1, "total_failed_items": 0, "failed_items": []}, "message": "All specified syscollector information was returned", "error": 0}
Filebeat config
filebeat.inputs:
- type: log
enabled: true
paths:
- syscollector.log
json.keys_under_root: true
json.add_error_key: true
json.message_key: log
processors:
- drop_fields:
fields: [ "message" , "error" ]
- add_tags:
tags: ["wazuh", "sys-wazuh"]
output.logstash:
hosts: ["x.y.x.v:port"]
Any ideas?
Thanks in advance
)