Logstash override host with filebeat name

Question

I have setup the FileBeat -> Logstash -> ElasticSearch -> Kibana set-up successfully. Now in logstash I want to override the host with the beat.name. However, When I try to refer to the beat metadata, the variable is not resolved.

    mutate {
        add_field => {
            "timestamp" => "%{year}-%{month}-%{day} %{time}"
        }
        replace_field => {
            "host" => "%{[@metadata][beat][name]}"
        }
    }

I think I am missing some major configuration. Even when Logstash forwards it to elasticsearch, these symbol resolution are not done.

output {
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }

How do we refer to filebeat meta information in logstash config file correctly?

Answer 1

The beat.name field is not carried in the @metadata object. beat is a top-level field in the event. So to refer to the value use [beat][name] or in string use "%{[beat][name]}".