Various pages on the Filebeat documentation describe inputs: Configure inputs | Filebeat Reference [8.10] | Elastic . Similarly, processors are documented: Filter and enhance data with processors | Filebeat Reference [8.10] | Elastic .
Neither input nor processor documentation documents which fields these things export. For example, the filestream input plugin page describes all the possible configuration options and even which metrics it exports, but not actually which fields to expect from it.
Same for processors. For example, the add_docker_metadata page says that "each event is annotated with: Container ID, Name, Image, Labels", but it does not document the actual field names in which these annotations are stored.
Then there are pages describing which fields are exported by inputs and processors: Exported fields | Filebeat Reference [8.10] | Elastic . However these are grouped by "categories", and it's not made clear what the relationship is between these categories and the input plugins and processors.
Am I the only one that's bothered by this? How do people figure out which fields to get, apart from actually using an input plugin or processor in a filebeat config and trying it out?
I would expect each input plugin and each processor to document the possible exported fields, and how these are obtained.
Is this just work someone still needs to do? Or has this been omitted deliberately?
Thanks!
Frans