Here I have installed packetbeat. So in the time learning the configuration for packetbeat I saw a file fields.yml in the directory /etc/packetbeat. I tried to get any information about that file but do not get source.....

Please can anybody tell me how work that file, or send any documentation?


To preface this, I'm not a packetbeat user, but I have used heartbeat, winlogbeat, filebeat, etc...

Generally speaking fields.yml contains fields that your beat specifically uses. Some of these fields are configured to certain values by default, for example "name" which defaults to your server's hostname, @timestamp which tracks time, in filebeat's case, "when the event log record" was generated. Other fields may be filled out by you manually in the main YAML of the beat you're using. Examples of this include "fields" which is intended to store user-generated fields, and "tags" which allows both you and other pieces of the elastic stack to tag data for identification, you may have seen logstash tag an event with "_jsonparsefailure" or you may tag your own data to correlate it easily with a particular system or network. In most beats however, the majority of the fields included in fields.yml are fields that pertain to the type of information you are collecting, the main exception being filebeat, as it is intended to be flexible. This means that for winlogbeat, auditbeat, packetbeat, etc.. Every field for every supported event is contained in this file.

Expanding on this to pertain to Packetbeat specifically, because packetbeat only generates events which contain predefined fields(unlike filebeat), all possible fields that packetbeat uses are listed in fields.yml. You can view these fields on a per-protocol basis in:https://github.com/elastic/beats/tree/master/packetbeat/protos Under any protocol you have an interest in i.e. .../icmp/_meta/fields.yml

The post-compilation fields.yml you see is an aggregation of each of these individual fields.yml files.

There isn't a lot of documentation that I could find regarding this, so as far as saying a definitive reason for why this file needs to exist. My guess is that this yaml file is used to generate an Index Template for elasticsearch, on a per-beat basis, which is why it is present in the config directories of most beats.

Related reading regarding index templates can be found here: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

You can grab the fields your index is mapped to use either by: GET /index-name (If you used the beat's index template) or using this guide https://www.elastic.co/guide/en/beats/packetbeat/master/packetbeat-template.html

  • very great my friend, that's all what I needed, thank you and good luck. – khachikyan97 Oct 11 '20 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.