Search code examples
logstashfilebeat

How to access available fields of @metadata in logstash


A sample logstash is running and getting input data from a filebeat running on another machine in the same network. I need to process some metadata of files forwarded by filebeat for example modified date of input file. I found that this information may be available in @metadata variable, and can access some fields like this:

  %{[@metadata][type]}
  %{[@metadata][beat]}

but I don't know how to access all kind of data stored in this field so that i'll be able to extract my own data.


Solution

  • You can add the following configuration to your logstash.conf file:

    output { 
       stdout { 
         codec  => rubydebug {
         metadata => true
        }
      }
    }
    

    https://www.elastic.co/blog/logstash-metadata

    But this field does not contain metadata of input file