I’m struggling with this for a while. I have Filebeat running, and it is sending logs successfully, but in the Graylog UI the source appears as unknown.
I have tried without fields_under_root, but it seems it stops sending at all.
Is there any way to parametrize source field in Graylog?
My filebeat config:
# Needed for Graylog
- input_type: log
I can’t test it right now but my first guess is instead of
you could try
@wmlodzianowski simple as @tmacgbay suggest.
put in your third line:
that should be fixed now.
Thanks guys, but I have already tried it and it puts the name in the field filebeat.source thanks to fields_under_root: true and I want it to be in source column in graylog ui. I tried also to set fields_under_root: false and provide Graylog fields by full path but then it doesn’t send logs at all.
so, did you checked the box at the beats input? The very last one? What is the exact configuration of your beats input on Graylog
it was unchecked. Checking it did the trick. Thanks a lot!
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.