Greetings,
I have in filebeat.yml
filebeat.modules:
- module: nginx
access:
var.paths: ["/var/log/nginx/access.log"]
error:
var.paths: ["/var/log/nginx/error.log"]
- module: system
syslog:
var.paths: ["/var/log/messages"]
auth:
var.paths: ["/var/log/secure"]
I would like to have message field in all events. I see that e.g. system.auth does not retain message entry. How can I add field with original line from the logfile?