Field agent collides with filebeat agent field in grok COMBINEDAPACHELOG pattern
d3vnick opened this issue · comments
As confirmed by Pier-Hugues Pellerin in this discussion, agent field in filebeat collides with agent field in COMBINEDAPACHELOG grok pattern:
COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}
Workaround
Expand %{COMBINEDAPACHELOG} and replace agent with something else:
%{COMMONAPACHELOG} %{QS:referrer} %{QS:somethingelse}
Version afflicted
- filebeat 7.2.X (from discussion)
- filebeat 7.6.1