Filebeat ACC management.

Products

• DX SaaS
• DX Operational Observability

Issue/Introduction

Administrators managing Infrastructure Agents (IA) with Filebeat extensions via the Agent Command Center (ACC) may want to configure advanced log processing rules, specifically:

Filtering log levels: Dropping INFO, DEBUG, or ALL states to only forward WARN, ERROR, or FATAL logs.

Tagging logs: Appending specific functional tags or custom fields to logs originating from distinct sources (e.g., prod-label1, prepod-2, qa-label).

 

Environment

DXO2 SaaS

DXO2 26.1 on-prem

Resolution

Currently, configuring these specific, granular Filebeat processing rules and custom input tags is not supported natively through the ACC.

ACC is designed to deploy and manage standard, lightweight agent configurations. Advanced log routing, parsing, dropping, and field mutation rely on specific Filebeat inputs and processors blocks, which must currently be configured directly at the agent/Filebeat level rather than pushed centrally via ACC in current design.