I am using filebeat on kubernetes. My filebeat.yaml looks like this:
filebeat.autodiscover:
providers:
- type: kubernetes
node: ${NODE_NAME}
templates:
- condition:
equals:
kubernetes.labels.app: app-name
config:
- type: container
paths:
- /var/log/containers/*${data.kubernetes.container.id}.log
processors:
- decode_json_fields:
fields: ["message"]
process_array: true
max_depth: 1
target: "Message"
overwrite_keys: false
add_error_key: true
However on my kibana dashboard in Mesasge Coloum I am having logs like this:
{
"log.level": "info",
"@timestamp": "2023-12-14T11:59:24.638Z",
"log.origin": {
"file.name": "filename",
"file.line": 270
},
"message": "Received Request",
"trace.id": "xxx",
"transaction.id": "xxx",
"user.name": "username",
"ecs.version": "1.6.0"
}
But I want something like this
[Info] "Received Request"
How can I achieve this?
Note: The log file contains the log in the following format on k8s node.
directory: /var/log/containers/*${data.kubernetes.container.id}.log
2023-12-14T12: 13: 59.872959737Z stdout F {
{
"log.level": "info",
"@timestamp": "2023-12-14T11:59:24.638Z",
"log.origin": {
"file.name": "filename",
"file.line": 270
},
"message": "Received Request",
"trace.id": "xxx",
"transaction.id": "xxx",
"user.name": "username",
"ecs.version": "1.6.0"
}