Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Journalbeat and Hashicorp Vault
journalbeat.inputs:
id: vault.service
include_matches:
- systemd.unit=vault.service
processors:
- add_fields:
target: event
fields:
module: vault
dataset: vault.log
- convert:
when.regexp.message: '^\s*{'
fields:
- from: message
to: event.original
mode: rename
- decode_json_fields:
fields:
- event.original
target: vault.log
- convert:
ignore_missing: true
mode: rename
fields:
- {from: 'vault.log.@message', to: message}
- {from: 'vault.log.@module', to: log.logger}
- {from: 'vault.log.@level', to: log.level}
- timestamp:
ignore_missing: true
field: 'vault.log.@timestamp'
layouts:
- "2006-01-02T15:04:05.999Z"
test:
- "2020-05-07T21:44:47.82217971Z"
- drop_fields:
fields: [vault.log.@timestamp]
log_format = "json"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment