how to set custom tag in filebeat output.elasticsearch _stream_fields

[dw130]

Is your question request related to a specific component?

VictoriaLogs

Describe the question in detail

hi,use filebeat to collect log to victoriaLog
use the sample conf
https://docs.victoriametrics.com/victorialogs/data-ingestion/filebeat/

output.elasticsearch:
hosts: ["http://localhost:9428/insert/elasticsearch/"]
parameters:
_msg_field: "message"
_time_field: "@timestamp"
_stream_fields: "host.hostname,log.file.path"

How to add some custom tag in the _stream_fields?
for example add region = xx1, app = xx2 into the _stream_fields

Thanks

Troubleshooting docs

• General - https://docs.victoriametrics.com/troubleshooting/
• vmagent - https://docs.victoriametrics.com/vmagent/#troubleshooting
• vmalert - https://docs.victoriametrics.com/vmalert/#troubleshooting

[AndrewChubatiuk]

hey @dw130
it's possible to set custom fields in general options of filebeat (or for each input separately) and use them in elasticsearch output like this:

fields:
    region: xx1
    app: xx2
output.elasticsearch:
   hosts: ["http://localhost:9428/insert/elasticsearch/"]
   parameters:
      _msg_field: "message"
      _time_field: "@timestamp"
      _stream_fields: "host.hostname,log.file.path,fields.region,fields.app"

[dw130]

Thanks,It works @AndrewChubatiuk