Hi, I'm using filebeat for providing logs to ELK stack. Log files are composed of json lines. I also added custom fields to output with filebeat.
When I saved log files utf8 with bom signature, Filebeat doesn't add custom fields to the first line of each log file. If I save log files utf8 without the signature It runs without any problem.
Yes, actually there is an error line in the log. After the error line, It wrote the event to the debug log with custom fields as should be. But, it didn't output this event with custom fields to logstash.
It also removes other additional fields like source, beat, offset etc. I've added logstash output below.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.