Using variables in fields output

Elastic Stack Beats
1

I need to pass a field from filebeat to kafka viz. host which is nothing but the host name of the machine from the logs are read. Though Filebeat sends the hostname in the beat properties, I need this in a separate field so that it conforms to the kafka topic's expected schema. Right now, I have created a field as

fields:
host: ${COMPUTERNAME}
fields_under_root: true

Though this works, I would like to know if there is a better way of achieving this such as using any variable in beat itself. Any help will be appreciated.

2

What do you mean by "any variable in beat itself"?

Environment variables or command line flag ( -E computername=xyz) are the only things I can think of other than using some outside tool to manage the configuration file.

3

Hi Andrew, thanks for the quick reply. What I meant by beat variable is that I can see by default beat sends the host name inside beat.hostname. So, is there a way to reuse that in a custom field rather than using an environment variable?

4

No, it's not possible to reference other field values. You could use Logstash to rename fields or copy data.

5

Thanks Andrew. Will think of using Logstash as an alternative. Appreciate the help...

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.