I've got filebeat setup sending logs to kibana. I have the apache module enabled which is sending the httpd error and access logs to kibana. I can filter on these by looking at the event.dataset field or the fileset.name field as shown in the example screenshot here.

For the tomcat logs I have an input setup in the filebeat.yml file. Although this is sending the logs to kibana/elasticsearch no problem the values for event.dataset or fileset.name are empty. This means I don't know how to filter on just those logs in kibana.

Is there a way to edit those fields for my inputs? If not those specific fields are there fields I can set and then access through the kibana UI?

I've read the documentation here but I don't find it very clear on how to then filter on fields in kibana.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.