Starting in version 7.16, this experimental functionality has been removed. You
should use the journald input in Filebeat instead.
Add fields
editAdd fields
editThe add_fields
processor adds additional fields to the event. Fields can be
scalar values, arrays, dictionaries, or any nested combination of these. By
default the fields that you specify will be grouped under the fields
sub-dictionary in the event. To group the fields under a different
sub-dictionary, use the target
setting. To store the fields as
top-level fields, set target: ''
.
-
target
-
(Optional) Sub-dictionary to put all fields into. Defaults to
fields
. -
fields
- Fields to be added.
For example, this configuration:
processors: - add_fields: target: project fields: name: myproject id: '574734885120952459'
Adds these fields to any event:
{ "project": { "name": "myproject", "id": "574734885120952459" } }