Beats: Documentation on filebeat logstash-output is not clear for index setting

Created on 8 Feb 2017  路  3Comments  路  Source: elastic/beats

  • Version: any
  • Operating System: any

This documentation https://www.elastic.co/guide/en/beats/filebeat/5.2/logstash-output.html causes confusion in the role of the setting "index" , this might be a mistake in the doc due to differences of this setting between when it's used inlogstash-output versus when it's used in elasticsearch-output.

The document flow seems to also cause confusion as it starts with logstash configuration details.

bug docs

Most helpful comment

I think we should also make it more clear that metadata fields are not part of the event at output time.
E.g. if you are doing something like Filebeat -> LS1 -> Redis -> LS2.
The meta data fields populated by Filebeat are only existent onLS1 and will not be passed to Redis, thus also missing in LS2 unless copied to a normal field via mutate or something in LS1.

All 3 comments

The "index" option is passed to the Logstash metadata, and can be used in the LS elasticsearch output (that's the purpose of the LS configuration samples). The docs should definitely be clarified.

The document flow seems to also cause confusion as it starts with logstash configuration details.

Pinging @dedemorton for this one :)

I think we should also make it more clear that metadata fields are not part of the event at output time.
E.g. if you are doing something like Filebeat -> LS1 -> Redis -> LS2.
The meta data fields populated by Filebeat are only existent onLS1 and will not be passed to Redis, thus also missing in LS2 unless copied to a normal field via mutate or something in LS1.

Resolved in #3866

Was this page helpful?
0 / 5 - 0 ratings