Problema with docker-filebeat with logstash add_field input

[gdelucchi]

Hi, I make a container with docker-filebeat and send the logs to logstash. In logstash I tried add_field in the input configuration but does not work.

Mi config file is above , I need add_field if the event in on port 5055

input { beats { port => 5044 id => "comex" } beats { port => 5055 add_field => { "origen" => "docker" } } }

output { elasticsearch { hosts => ["127.0.0.1:9200"] index => "docker2" } elasticsearch { hosts => ["127.0.0.1:9200"] index => "comex-%{+YYYY.MM.dd}" }

file { path => "/tmp/logstash.txt" } }

The output event is:

{"fields":null,"tags":["beats_input_codec_plain_applied"],"count":1,"beat":{"name":"docker01.bbva.internal","hostname":"e080a9066ea7"},"@version":"1","offset":7073267,"source":"-","type":"filebeat-docker-logs","message":"[competent_yonath] \u0002\u0000[competent_yonath] \u0000[competent_yonath] \u0000[competent_yonath] \u0000[competent_yonath] \u0000[competent_yonath] \u0000[competent_yonath] @2018/02/15 17:14:39.531213 publish.go:104: INFO Events sent: 17","host":"e080a9066ea7","@timestamp":"2018-02-15T17:14:46.009Z","input_type":"stdin"}

Thanks.