0

this is a slightly rephrased version of:

Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog)

i am using filebeat to collect logs from a bunch of docker containers, and then ship them to a graylog beats input. using tcpdump, i can see the messages coming in on the input's port, including the full complement of docker and aws metadata fields in the json:

0x10e0:  223a 7b22 7265 6769 6f6e 223a 2265 752d  ":{"region":"eu-
0x10f0:  6365 6e74 7261 6c2d 3122 2c22 6176 6169  central-1","avai
0x1100:  6c61 6269 6c69 7479 5f7a 6f6e 6522 3a22  lability_zone":"
0x1110:  6575 2d63 656e 7472 616c 2d31 6122 2c22  eu-central-1a","
0x1120:  696e 7374 616e 6365 5f69 6422 3a22 692d  instance_id":"i-
0x1130:  3034 6237 3133 3630 3633 6436 6165 3064  04b7136063d6ae0d
0x1140:  6122 2c22 6d61 6368 696e 655f 7479 7065  a","machine_type
0x1150:  223a 226d 342e 6c61 7267 6522 2c22 7072  ":"m4.large","pr
0x1160:  6f76 6964 6572 223a 2265 6332 227d 7d2c  ovider":"ec2"}},

however, messages within graylog are missing most of these, only the bare minimum of fields are present (see image below). i am wondering how i can get the rest to show up? or, rather, how do i control what's actually stored inside a message?

fields actually visible in graylog

rmalchow
  • 176
  • 6

1 Answers1

0

actually, i was just mistaken about what i was expecting from graylog. this is, however, obsolete now. the rewritten beats input in graylog 3 handles these fields just like i wanted it to.

rmalchow
  • 176
  • 6