I'm trying to solve this use case with journalbeat and elastic:
A process outputs json. I use the json processor in journalbeat (or in elastic ingest pipeline, same difference) to decode that output from field message to field json_message. I would like the output to be in field {{ name_of_process }} instead (eg. {{ journald.systemd_unit }}), to prevent type clashes (same process should not mix types, but different processes could).
I can not use templates in the json processor's target_field nor the rename processor's target_field.
Is there a specific reason for this, am I Doing Something Wrong(tm)?
I'm trying to solve this use case with journalbeat and elastic:
A process outputs json. I use the
jsonprocessor in journalbeat (or in elastic ingest pipeline, same difference) to decode that output from fieldmessageto fieldjson_message. I would like the output to be in field{{ name_of_process }}instead (eg.{{ journald.systemd_unit }}), to prevent type clashes (same process should not mix types, but different processes could).I can not use templates in the
jsonprocessor'starget_fieldnor therenameprocessor'starget_field.Is there a specific reason for this, am I Doing Something Wrong(tm)?