I am using filebeat (docker 7.4.1).
1)What is the difference between processor add_fields and regular "fields:"
- Also, I am using autodiscover for nginx/mongo containers AND regular filebeat.input of type container for all other container logs. I do not have a very good inbuilt field/property to differentiate between these two types so that I can exclude autodiscover containers from regular filebeat input of type containers.
Is there a good way to achieve this? Therefore I was wondering if I could add a custom field to be used in include_lines.
Appreciate any pointers.