I have in filebeat.yml
filebeat.modules: - module: nginx access: var.paths: ["/var/log/nginx/access.log"] error: var.paths: ["/var/log/nginx/error.log"] - module: system syslog: var.paths: ["/var/log/messages"] auth: var.paths: ["/var/log/secure"]
I would like to have message field in all events. I see that e.g. system.auth does not retain message entry. How can I add field with original line from the logfile?