Using a regex in the custom field of Filebeat

Elastic Stack Beats
2

hello @gvdm90, Currently, it's not possible to dynamically extract that information from an event and reuse it as a field with Filebeat, but we plan to add something in beats that will work like the dissect filter in Logstash.

But you can solve your problem by either one of the following options:

  1. Use the ingest node feature to do the processing, you can extract the app_name part using a grok processor and do more filtering after.

  2. Use Logstash with the beats inputs and the grok filter and send your events to Logstash instead of sending it directly to Elasticsearch.

What kind of filtering are you doing?