Use filebeat processor to concatenate string

Elastic Stack Beats
2

Hello @mistrhanky1

You can try using script processor or ingest pipeline shared in this post :

https://discuss.elastic.co/t/how-to-concatenate-two-fields-using-add-fields-processor-in-filebeat/306488/15

processors:
      - dissect:
          tokenizer: "%{f1}-%{f2}-%{f3}"
          field: message
          target_prefix: ""
          overwrite_keys: true

      - script:
          lang: javascript
          source: >
            function process(event) {
              var f1 = event.Get("f1");
              var f2 = event.Get("f2");
              var f3 = event.Get("f3");

              if (f1 && f2 && f3) {
                event.Put("message", f3 + "-" + f2 + "-" + f1);
              }
            }

Thanks!!

1 Like