I'm testing out filebeat on our elastic search logs. However, when the logs hit elasticsearch an "_jsonparsefailure" tag gets added by the beats input in logstash.
Can I ask, what format does beats use for sending to logstash? I'm using the "json" codec atm. Should I be using something else?