Log source "unknown" in Observability Overview

[strophy]

I'm new to Elastic Stack and have successfully set up a pipeline with Filebeat, Elasticsearch and Kibana to ingest data from log files. I have set up the display fields in Observability settings, which works for the Logs view, but I can't see where to define the source so it doesn't appear as "Unknown" in the Overview chart:

Can anyone tell me where this is done or point me to the right docs? Thanks!

[felixbarny (Felix Barnsteiner)]

Hi and welcome to the forum

You'll have to populate the event.dataset field for that which helps you to differ between log streams. The default value our ECS logging libraries use is ${serviceName}.log, for example my-app.log.

[strophy]

Works great! Thanks for the friendly welcome and quick response

[fzyzcjy]

Hi, how can I set up the serviceName? I have tried the following but only service name is set, and event.dataset is not set.

I guess it is not the best way to set up service name... Is there any suggested approach to set up service.name for any general services?

...
          - rename:
              fields:
                - from: "spring.message"
                  to: "message"
                - from: "spring.application_name"
                  to: "service.name"

Thanks!