I know that we can add custom fields in metricbeat.yml file as,
fields:
customfield1: value1
customfield2: value2
Then the JSON output would be generated as,
{
"@timestamp": "2018-03-15T17:00:04.392Z",
"@metadata": {
"beat": "metricbeat",
"type": "doc",
"version": "6.2.2"
},
"metricset": {
"rtt": 801,
"name": "status",
"module": "kibana",
"host": "localhost:5601"
},
"error": {
"message": "error making http request: Get http://localhost:5601/api/status: dial tcp [::1]:5601: getsockopt: connection refused"
},
"fields": {
"customfield1": "value1",
"customfield2": "value2"
},
"beat": {
"name": "TheNameOfBeat",
"hostname": "localhost",
"version": "6.2.2"
}
}
But I want to add the custom fields to the source of the JSON message and not inside the "fields" object. Is this possible?
Something like,
{
"@timestamp": "2018-03-15T17:00:04.392Z",
"customfield1": "value1",
"customfield2": "value2",
"@metadata": {
"beat": "metricbeat",
"type": "doc",
"version": "6.2.2"
},
"metricset": {
"rtt": 801,
"name": "status",
"module": "kibana",
"host": "localhost:5601"
},
"error": {
"message": "error making http request: Get http://localhost:5601/api/status: dial tcp [::1]:5601: getsockopt: connection refused"
},
"beat": {
"name": "TheNameOfBeat",
"hostname": "localhost",
"version": "6.2.2"
}
}
Found the solution in How can I parse custom Metricbeat dictionary for Kibana? Need to set the fields_under_root option to true.