How could I reserve message filed with json.keys_under_root is set

Hi, I'm using filebeat to collect my logs from servers.

I'm confused whether it's possible to reserve message filed when I set json.keys_under_root true.

The fields I hava set:

- type: docker
    path: "/mnt/data/docker/data/containers"
      - "*"
    keys_under_root: true
    overwrite_keys: true

After set these fields, the message field disappeared, I want reserve both message fields and the json function.

Hope to get replys!

Why nobody reply :frowning:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.