"Unknown" logs in observability overview

[mar-ro (Miguel)]

Good morning. When I click on the menu called "Observability Overview" it shows me an image with "Logs per minute rate" but all the bars in this image appear as "Unknown". I was searching in this forum and I could find another user who has the same question as me, but I still don't know how to change this "label" called "Unknown" to a custom one. From what I saw answered to this other user I understand that it can be done using logstash but can I do it directly from the filebeat configuration? Thanks!

[felixbarny (Felix Barnsteiner)]

As described in the thread you linked, your best bet would be to use ECS loggers and to define the event.dataset field. If that's not an option, you can use an add_fields processor to manually add this field in your Filebeat configuration.

Example:

processors:
  - add_fields:
      target: ''
      fields:
        event:
          dataset: my-app.log

[mar-ro (Miguel)]

Thank you very much for your reply Felix.
In my /etc/filebeat/filebeat.yml file I have the following:

# ============================== Filebeat inputs ===============================
filebeat.config.inputs:
  enabled: true
  path: inputs.d/*.yml

And in /etc/filebeat/inputs.d/ I have the files nginx.yml and crontab.yml among others.
I tried to include the code you indicated in the nginx.yml and crontab.yml file but modifying the dataset value but when I restart the filebeat service it fails. I looked up the processors documentation and found this Define processors | Filebeat Reference [7.12] | Elastic , according to which I understand that I could include a processors field inside an input (like the ones I have in nginx.yml and crontab.yml) but despite that, it still crashes when restarting the service.

I tried to include this processors field only in /etc/filebeat/filebeat.yml and there it doesn't fail, but of course, I can't distinguish between the different datasets. I think the solution could be to use the when tag, but I'm not sure how to use it to identify the file path, that is, that the value of the dataset is the same as the file path, is this possible?

Thank you very much in advance.

Best regards

[felixbarny (Felix Barnsteiner)]

@mar-ro

I could include a processors field inside an input (like the ones I have in nginx.yml and crontab.yml )

What's the error message you get?
How does your nginx.yml look like?

@mar-ro

the value of the dataset is the same as the file path, is this possible?

I'm out of my depth here, not sure if that's possible.