Journalbeat message format

Hello, I'm looking for documentation on the journalbeat message format? I need to understand what I can about the format in order to understand the tradeoffs related to batching.


Welcome to the community @cartesian-theatrics

Here are the exported fields of journalbeat. Is this what you were looking for?

Not exactly, I was more hoping to better understand how messages are compressed and serialized before being shipped, in order to better understand the cost of adding additional fields, as well to better understand the tradeoff between larger and smaller batch intervals.

To my understanding it just uses gzip to compress the messages. You could take a sample of your data and compress it with gzip using the compression ranges of 1-9 to see the results.