Filbeat export template

Elastic Stack Beats
1

I am using the version 6.4.2 of filebeat and elasticsearch. I am trying to upload the template into elasticsearch using the setup command. It works fine but when I saw the generated template (also through the filebeat export command) the fields under key: log are missing. The only generated mapping is:

        "log": {
          "properties": {
            "level": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },

It is missing the other properties like message e.t.c.

And because of this when I am sending docker logs the log.message field is getting indexed as a keyword type where as it should be text.

2

Are you using a module? Do you have any special fields? Could you please share your configuration formatted using </>?

3

I have not changed the configuration. It is what is supplied when you install the filebeat.
I just installed using sudo apt-get install metricbeat=6.4.2 after which I ran the sudo filebeat export template
The generated output has many fields under keys like logstash, mongodb etc but under logs its the same as what I posted.

4

Filebeat does not provide a field named log.message. Where does that field come from?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.