Custom field name not showing in Filebeat

Question

Below is how im trying to add a custom fiels name in my filebeat 7.2.0 filebeat.inputs:

- type: log
  enabled: true
  paths:
    - D:\Oasis\Logs\Admin_Log\*
    - D:\Oasis\Logs\ERA_Log\*
    - D:\OasisServices\Logs\*
  processors:
- add_fields:
     fields:
     application: oasis

and with this, im expecting a new field called application whose data entries will be 'oasis'. But i dont get any. I also tried

 fields:
    application: oasis/'oasis'

Help me with this.

score 0 · Answer 1 · answered Dec 17 '19 at 10:58

0

If you want to add a customized field for every log, you should put the "fields" configuration in the same level of type. Try the following:

- type: log
  enabled: true
  paths:
    - D:\Oasis\Logs\Admin_Log\*
    - D:\Oasis\Logs\ERA_Log\*
    - D:\OasisServices\Logs\*
  fields.application: oasis

answered Dec 17 '19 at 10:58

for_stack

21,012
4
35
48

It doesn't seem to work. Im not even able to start the application as a windows service. – AlisonGrey Dec 18 '19 at 04:50

score 0 · Answer 2 · answered Dec 20 '19 at 02:18

There are two ways to add custom fields on filebeat, using the fields option and using the add_fields processor.

To add fields using the fields option, your configuration needs to be something like the one below.

filebeat.inputs:
- type: log 
  paths:
    - 'D:/path/to/your/files/*'
  fields:
    custom_field: 'custom field value'
  fields_under_root: true

To add fields using the add_fields processor, you can try the following configuration.

filebeat.inputs:
- type: log 
  paths:
    - 'D:/path/to/your/files/*'
processors:
- add_fields:
    target: ''
    fields:
      custom_field: 'custom field value'

Both configurations will create a field named custom_field with the value custom field value in the root of your document.

The fields option can be used per input and the add_fields processor is applied to all the data exported by the filebeat instance.

Just remember to pay attention to the indentation of your configuration, if it is wrong filebeat won't work correctly or even start.

Hi @leandrojmp, Aplogies for responding late, i have tried the processors part and i still see no update, should i clear the old index as well? — AlisonGrey, Dec 24 '19 at 10:08

Custom field name not showing in Filebeat

2 Answers2