Filebeat should omit timestamp in logs when ran via systemd

Elastic Stack Beats
1

Currently logs via systemd look like this:

Mar 08 13:13:10 appserv1 filebeat[22055]: 2022-03-08T13:13:10.657+0100  INFO    instance/beat.go:694    Beat ID: 70152ff2-5b2e-4c03-a60c-eedffb110c54

and the timestamp is doubled. There should be option to run it without the timestamp, either via CLI option or autodetection (IIRC systemd sets few environmental variables like JOURNAL_STREAM and INVOCATION_ID so it could change format string based on that). In my code I used

        if os.Getenv("INVOCATION_ID") != "" || os.Getenv("JOURNAL_STREAM") != "" {
            consoleEncoderConfig.TimeKey = ""
    }

(for go.uber.org/zap) with good success.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.