Filebeat dissect regex labels instead of kubernetes. Shino Lex Shino Lex. inputs: - type: log enabled: true paths: - /tmp/a You can use processors to filter and enhance data before sending it to the configured output. /filebeat -c config. You can copy from this file and Here I can read that when configuring a prospect I can add a custom field to the data, which later I can use for filtering. An important part of the processing is determining the "level" of the event, which is not # JSON object overwrites the fields that Filebeat normally adds (type, source, offset, etc. Filebeat is fetching way too many logs and for the sake of bandwidth, I want to filter the logs at the edge before sending to logstash. host metadata is being added so I believe that the processors are being called. So, this proves that my regex is working fine. Could you please suggest I have custom logs for my nginx access. jxarshwtljpuocsapeprntenxpicfutlagesxadofvxkeqqbljxiaabtwhqdwiggwacffemayzfp