Include user.name field in journalbeat

Elastic Stack Beats
1

Hi!

I have a quite minimalist journalbeat config pushing my journal to elasticsearch but I'm missing the user.name field (I have user.id). I see that it is disabled by default in the reference, but in my index settings it seems to be enabled.

How should I proceed to get that field ?
Here's my journalbeat config:

journalbeat.inputs:
- paths: []
  seek: cursor

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:

output.elasticsearch:
  hosts: ["x:9443"]
  protocol: "https"
  username: "journalbeat"
  password: "x"

processors:
  - add_host_metadata: ~

logging.level: warning
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.