So I know events coming from filebeat into logstash have a "source" field related to the full path of the file. The problem is my json file that I am sending will occasionally also have a 'source' field, which seems to behave in inconsistent ways. Previously (version 6.1 I think) I could rename 'source' field from JSON to keep that (dropping filebeat file path 'source') but now in 6.2 I can only get the filebeat 'source' field and cannot access JSON 'source' field. Any ideas?
For reference, I'm ingesting JSON bro logs (files.log)