How to configure Filebeat to consume logs in JSON format that are already in ECS format

xprzemekw · May 26, 2020, 8:07am

Hi,

I am new to Elastic and struggling with configuring Filebeat to read logs in JSON that are already in the Elastic Common Schema format.

I was inspired by the https://github.com/elastic/ecs-dotnet/tree/master/src/Elastic.CommonSchema.NLog project. When properly configured NLog should emit ECS formatted JSON messages to the log file, one message per line.

How to configure Filebeat to get them and send to Elastic? I assume logs need no processing as they are already in ECS format, just send to Elastic.

How to achieve that? Any guidance welcome

system · June 23, 2020, 8:07am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
What is the best practice to convert my custom logs to ECS(Or not) Beats filebeat	3	1277	October 31, 2019
Ingesting ECS ndjson via http_endpoint? Beats ecs-elastic-common-schema , filebeat	1	540	January 3, 2022
Do we need to add ECS Logger to our Filebeat just to get log.level as a field in the JSON? Beats ecs-elastic-common-schema , filebeat	8	640	May 18, 2023
Issue with JSON logs and field 'log.level' Beats filebeat	3	416	July 30, 2019
Some logs with more json fields are not processed (Filebeat 8.3.3) Beats filebeat	4	812	September 5, 2022