Pipelines, JSON, array for tags

[gsmith]

Hello @benoitp

@benoitp

trying to replicate a Beat input behavior for tags with Pipelines and “flatten_json”

Your using Filebeat. Correct me if im wrong, filebeat currently only sends JSON documents.

But the Pipeline shows, and again correct me if im wrong you trying to get the Message field and flatten it out when I believe you are already sending it in json format. In this case I would suggest when useing Filebeat then use the Beat input.

Here is a good Example:

Rsyslog app name

This is just the auth collector configuration you can add multiple log files into one collector - if you need more help with setting up filebeats, start a new thread… # Needed for Graylog fields_under_root: true fields.collector_node_id: ${sidecar.nodeName} fields.gl2_source_collector: ${sidecar.nodeId} filebeat.inputs: - type: filestream id: id-linux-auth enabled: true paths: - /var/log/auth.log tags: - linux logging.metrics.enabled: false fields: os_ver: u…