Hi, I'm using filebeat to collect my logs from servers.
I'm confused whether it's possible to reserve message filed when I set json.keys_under_root true.
The fields I hava set:
- type: docker
containers:
path: "/mnt/data/docker/data/containers"
ids:
- "*"
json:
keys_under_root: true
overwrite_keys: true
After set these fields, the message field disappeared, I want reserve both message fields and the json function.
Hope to get replys!