Parsing the message field with filebeat processors is great, as it allows structured search for logs, but one thing that surprises me is that the message field itself is destroyed. This means that just casual viewing of logs in Kibana or tools like elktail will just shown an empty log message. Here is an example from a Kibana dashboard:
You then have to either add several of the destructured fields to the output, or click into the details of each one. This is not appealing when just trying to get an overall view of a set of logs before digging into the details.
In addition, if I search for
message:(something) I won't find it. I have to know which destructured field contains
something to do a search.
Can filebeat be configured to parse data out of the message, but leave the
message field as-is rather than destroying it?