Easier acces to information regarding the default fields sent by all the Beats

Elastic Stack Beats
1

Hi there,

I have a quick suggestion to improve the documentation of all the beats. Why don’t you add a section explaining the default fields that are expected of the beats, in the documentation?

I don’t have to work often with filebeat or metricbeat, just once in a while to make a new integration or some sort of modification, and when the time comes, I always find myself with the same problems: what parameters is my filebeat sending to logstash? And sadly, I never find a place in the documentation that shows a list of the parameters you should be expecting, which makes creating new pipelines even slower, since you are never sure whether you can count on having a hostname field or a log.file.path field. I can be certain of the parameters I am sending using the modules, but not the default ones.

2

Wouldn't these documentation have this information?

For Filebeat: Exported fields | Beats

and

For Metricbeat: Exported fields | Beats

The fields will depend on which module is being used and also if you have any metadata processor enabled.

For example, if you add the add_host_metadata processor, you should expect host fields like these: Add Host metadata | Beats

1 Like