From 41e3b04b250bfe6074b9fe6a6683d01cb16d268d Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 16 Oct 2018 21:00:04 -0400 Subject: [PATCH] Logstash Module - Sensors now show up correclty --- salt/filebeat/etc/filebeat.yml | 4 ++-- salt/logstash/files/dynamic/0006_input_beats.conf | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml index 91fff5455..ac95289f7 100644 --- a/salt/filebeat/etc/filebeat.yml +++ b/salt/filebeat/etc/filebeat.yml @@ -1,8 +1,8 @@ {%- set MASTER = salt['pillar.get']('sensor:master', '') %} {%- set HOSTNAME = salt['grains.get']('host', '') %} -beat.name: {{ HOSTNAME }} - +name: {{ HOSTNAME }} + #========================== Modules configuration ============================ filebeat.modules: #=========================== Filebeat prospectors ============================= diff --git a/salt/logstash/files/dynamic/0006_input_beats.conf b/salt/logstash/files/dynamic/0006_input_beats.conf index dd4f20ba7..d3615b126 100644 --- a/salt/logstash/files/dynamic/0006_input_beats.conf +++ b/salt/logstash/files/dynamic/0006_input_beats.conf @@ -13,16 +13,16 @@ filter { mutate { rename => { "host" => "beat_host" } remove_tag => ["beat"] - copy => {"%{beat[name]}" => "sensor_name"} - copy => {"%{beat[name]}" => "syslog-host_from"} + add_field => { "sensor_name" => "%{[beat][name]}" } + add_field => { "syslog-host_from" => "%{[beat][name]}" } } } if "bro" in [tags] { mutate { rename => { "host" => "beat_host" } remove_tag => ["beat"] - copy => {"%{beat[name]}" => "sensor_name"} - copy => {"%{beat[name]}" => "syslog-host_from"} + add_field => { "sensor_name" => "%{[beat][name]}" } + add_field => { "syslog-host_from" => "%{[beat][name]}" } } } }