Keep or restore message

Greetings,
I have in filebeat.yml

filebeat.modules:
- module: nginx
  access:
    var.paths: ["/var/log/nginx/access.log"]
  error:
    var.paths: ["/var/log/nginx/error.log"]
- module: system
  syslog:
    var.paths: ["/var/log/messages"]
  auth:
    var.paths: ["/var/log/secure"]

I would like to have message field in all events. I see that e.g. system.auth does not retain message entry. How can I add field with original line from the logfile?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.