Functionbeat will reach End of Support on October 18, 2023. You should consider moving your deployments to the more versatile and efficient Elastic Serverless Forwarder.
« Decompress gzip fields Dissect strings »
Elastic Docs ›Functionbeat Reference [8.8] ›Configure Functionbeat ›Filter and enhance data with processors

Detect mime type

edit

Detect mime type

edit

The detect_mime_type processor attempts to detect a mime type for a field that contains a given stream of bytes. The field key contains the field used as the data source and the target key contains the field to populate with the detected type. It’s supported to use @metadata. prefix for target and set the value in the event metadata instead of fields.

processors:
  - detect_mime_type:
      field: http.request.body.content
      target: http.request.mime_type

In the example above: - http.request.body.content is used as the source and http.request.mime_type is set to the detected mime type

See Conditions for a list of supported conditions.

« Decompress gzip fields Dissect strings »