- Functionbeat Reference:
- Overview
- Getting Started With Functionbeat
- Setting up and deploying Functionbeat
- Configuring Functionbeat
- Configure functions
- Specify general settings
- Configure the internal queue
- Configure the output
- Configure index lifecycle management
- Specify SSL settings
- Filter and enhance the exported data
- Define processors
- Add cloud metadata
- Add fields
- Add labels
- Add the local time zone
- Add tags
- Decode JSON fields
- Decode Base64 fields
- Decompress gzip fields
- Community ID Network Flow Hash
- Convert
- Drop events
- Drop fields from events
- Extract array
- Keep fields from events
- Registered Domain
- Rename fields from events
- Add Kubernetes metadata
- Add Docker metadata
- Add Host metadata
- Add Observer metadata
- Dissect strings
- DNS Reverse Lookup
- Add process metadata
- Parse data by using ingest node
- Enrich events with geoIP information
- Configure the Kibana endpoint
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- YAML tips and gotchas
- Regular expression support
- functionbeat.reference.yml
- Exported fields
- Monitoring Functionbeat
- Securing Functionbeat
- Troubleshooting
- Get help
- Debug
- Common problems
- Deployment to AWS fails with "failed to create the stack"
- Deployment to AWS fails with "resource limit exceeded"
- Error loading config file
- Found unexpected or unknown characters
- Logstash connection doesn’t work
- @metadata is missing in Logstash
- Not sure whether to use Logstash or Beats
- SSL client fails to connect to Logstash
- Monitoring UI shows fewer Beats than expected
A newer version is available. For the latest information, see the
current release documentation.
Add fields
editAdd fields
editThe add_fields
processor adds additional fields to the event. Fields can be
scalar values, arrays, dictionaries, or any nested combination of these. By
default the fields that you specify will be grouped under the fields
sub-dictionary in the event. To group the fields under a different
sub-dictionary, use the target
setting. To store the fields as
top-level fields, set target: ''
.
-
target
-
(Optional) Sub-dictionary to put all fields into. Defaults to
fields
. -
fields
- Fields to be added.
For example, this configuration:
processors: - add_fields: target: project fields: name: myproject id: '574734885120952459'
Adds these fields to any event:
{ "project": { "name": "myproject", "id": "574734885120952459" } }
Was this helpful?
Thank you for your feedback.