we were having filebeat running on 5.6 and it was working perfectly fine reading JSON formatted logs and this 5.6 version was sorting keys in each and every log line by default.
But 6.4 is not doing this, its not sorting the keys. What can be wrong? Do we need to make some chnages in filebeat.yml for 6.4 version?
5.6 version publishing log line as json line with all keys being sorted;
{"@timestamp":"2019-06-26T23:15:51.651Z","beat":{"hostname":"abc","name":"abc","version":"5.6.5"},"contextID":"sdfsffsf","directive":"NewCont","directiveExit":"","duration":1434,"eTime":"20190626T231544.364","input_type":"log","occurrence":1,"offset":7837,"source":"/abc/xyz/d-exit.log","sTime":"20190626T231542.930","type":"dExit"}
6.4 version publishing json object with keys in random order:
{"@timestamp":"2019-07-15T20:51:56.995Z","@metadata":{"beat":"filebeat","type":"doc","version":"6.4.3","topic":"d-exit"},"beat":{"name":"xyz","hostname":"xyz","version":"6.4.3"},"duration":424,"contextID":"dada","type":"dExit","offset":58322,"dExit":"","directive":"GDest","sTime":"20190715T205147.834","eTime":"20190715T205148.258","occurrence":2,"source":"/abc/xyzapplogs/d-exit.log"}