How to add additional fields when using im_file module

#1 zpp 8 years ago

Hi,

I'm using im_file module to read windows log file to elasticsearch, and I need to get source file name and some fix string like log type to elastic search as well. I used below configuration, but i couldn't find the FileName in elasticsearch, can someone help? thanks a lot!

<Input TestFileInput>
Module     im_file
   File 'E:\test\app*.log'
   Exec           $FileName = file_name();
</Input>

Permalink

#4 adm Nxlog ✓ 8 years ago

#1 zpp

Hi, I'm using im_file module to read windows log file to elasticsearch, and I need to get source file name and some fix string like log type to elastic search as well. I used below configuration, but i couldn't find the FileName in elasticsearch, can someone help? thanks a lot! <Input TestFileInput> Module im_file File 'E:\test\app*.log' Exec $FileName = file_name(); </Input>

The configuration is correct. Your fields are getting discarded elsewhere in the process when loading ES.