Description
Hi,
I make a container with docker-filebeat and send the logs to logstash. In logstash I tried add_field in the input configuration but does not work.
Mi config file is above , I need add_field if the event in on port 5055
input {
beats {
port => 5044
id => "comex"
}
beats {
port => 5055
add_field => {
"origen" => "docker"
}
}
}
output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "docker2"
}
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "comex-%{+YYYY.MM.dd}"
}
file {
path => "/tmp/logstash.txt"
}
}
The output event is:
{"fields":null,"tags":["beats_input_codec_plain_applied"],"count":1,"beat":{"name":"docker01.bbva.internal","hostname":"e080a9066ea7"},"@Version":"1","offset":7073267,"source":"-","type":"filebeat-docker-logs","message":"[competent_yonath] \u0002\u0000[competent_yonath] \u0000[competent_yonath] \u0000[competent_yonath] \u0000[competent_yonath] \u0000[competent_yonath] \u0000[competent_yonath] @2018/02/15 17:14:39.531213 publish.go:104: INFO Events sent: 17","host":"e080a9066ea7","@timestamp":"2018-02-15T17:14:46.009Z","input_type":"stdin"}
Thanks.