I started to play with filebeat, just set it up on my local box. I have a newbie question.
I set the output to be local file right now, eventually i would like to set it to kafka.
While I examined the output from filebeat, by default, it outputs many fields we are not interested, e.g., @timestamp, @type, or @input_type. The only things we are interested is "hostname, message, and source". Those extra fields wasted space/bandwidth from log output.
so I am wondering how can i change the default configuration to remove those fields?
is filebeat.template.json the right place to change this? I tried to remove certain filebeat.template.json, it did not work., Is there a documentation link for this?
I am also curious how ppl use these fields? e.g., read_timestamp, i.e., @timestamp just in case it might be useful and I should keep them..