Getting Data from Syslog into Elasticsearch/Kibana

I've just gotten my first Filebeats agent running and sending data into Elasticsearch, though I'm not sure why the messages are so long. I'm guessing everything after this @timestamp field is something from Beats or Elasticsearch? Not sure how to prune that out of the messages when viewing them or if I need to prune something from the Filebeats configuration.

Log message looks like so:

Apr 17 16:28:17 device="SFW" date=2021-04-17 time=16:28:17 timezone="EDT" device_name="SFVH" device_id=C01001DJD7TDY26 log_id=063711517815 log_type="Event" log_component="DDNS" log_subtype="System" status="Success" priority=Notice updatedip=my_ip_address reason="N/A" message="DDNS update for host was Successful. Updated with IP my_ip_address."

When I see the message in Kibana it looks like:

Beats is configured as such:

 # Kibana Host
   host: ""
 # ---------------------------- Elasticsearch Output ----------------------------
   # Array of hosts to connect to.
   hosts: [""]


 - module: sophos
     enabled: true
     # known firewalls
       - serial_number: "C01001DJD7TDY26"
         hostname: ""

    var.paths: /var/log/

Looks like possibly what I want is just the contents of this message field.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.