Custom Logs - json - Why do we need to map fields?

Elastic Stack Elastic Agent
7

What version are you on?

Shift Reload of Kibana should be sufficient to see fields.

so if your logs are ndjson you need to tell the integration to parse the json
if you do not all the json will just end up in the message field..

There are 3 ways to do that (of course always more than one way)

  1. ndjson parser
  2. decode_json_fields processor
  3. ingest pipeline

First 2 you can just set in the Integration Setup there used to be commented out sample but not any more