I’m trying collector-sidecar and currently facing an issue. I can (and probably should) configure filebeat settings from gray log site and those settings should be synchronized with all the sidecar service clients. If I understand correctly - to enable json parsing I need to use any of JSON option…

[image] giedrius: Has anyone else faced this issue? You can use snippets for that. http://docs.graylog.org/en/latest/pages/collector_sidecar.html#snippets

I’m quite new with that, from documentation it looks like it is possible to add to the end of configuration, but I need to go that under prospectors, like this: filebeat.prospectors: - input_type: log paths: ["test/*"] json.message_key: event json.keys_under_root: t…

[image] giedrius: Update: For some reason I can get it indented on post. You can use triple back ticks for that. See Markdown Reference for details.

I’ve read snippets documentation once again and there’s this statement: It’s also conceivable to put a full configuration file into a snippet and skip all of the input and output mechanism. So yey, it looks like what I need, so I’ve deleted filebeat input/output configuration and added configura…

I would say this is a bug, if there are no inputs/outputs configured we could skip the empty prospector array. So that a snippet can set it’s own. Feel free to open an issue in the Sidecar repository, can take a look then. Cheers, Marius

Thanks Marius, I’ve created issue in github.

For reference: [image] Issue: Empty configuration is inserted before snippet if no input/output configured opened by dziedrius on 2017-11-21 closed by bernd on 2018-02-15 Problem description When there is no collector input/output defined in collector's configuration for…

How to configure filebeat from graylog to parse json?

Graylog Central (peer support)

jochen (Jochen) November 21, 2017, 8:57pm 8

For reference:

Topic		Replies	Views
Parsing JSON format with Filebeat Graylog Central (peer support) filebeat-linux	2	631	December 16, 2024
Pipeline Issue - set_fields w/ JSON not working Graylog Central (peer support) sidecar , filebeat-windows	5	2061	November 21, 2019
Add filebeat log without logstash Graylog Central (peer support) sidecar , filebeat-linux , winlogbeat , nosendlogfblx	3	1081	December 30, 2018
Graylog sidecar and filebeat Graylog Central (peer support) pipeline-rules , sidecar , filebeat-linux , filebeat-windows , nosendlogfblx	57	10768	September 16, 2021
Filebeat json formatted messages being indexed with 'null' message body Graylog Central (peer support)	6	1865	April 2, 2018

How to configure filebeat from graylog to parse json?

Related topics