Log source "unknown" in Observability Overview

Elastic Observability Logs
1

I'm new to Elastic Stack and have successfully set up a pipeline with Filebeat, Elasticsearch and Kibana to ingest data from log files. I have set up the display fields in Observability settings, which works for the Logs view, but I can't see where to define the source so it doesn't appear as "Unknown" in the Overview chart:

image
image1992×684 40 KB

Can anyone tell me where this is done or point me to the right docs? Thanks!

2

Hi and welcome to the forum :wave:

You'll have to populate the event.dataset field for that which helps you to differ between log streams. The default value our ECS logging libraries use is ${serviceName}.log, for example my-app.log.

2 Likes
3

Works great! Thanks for the friendly welcome and quick response :slight_smile:

4

Hi, how can I set up the serviceName? I have tried the following but only service name is set, and event.dataset is not set.

I guess it is not the best way to set up service name... Is there any suggested approach to set up service.name for any general services?

...
          - rename:
              fields:
                - from: "spring.message"
                  to: "message"
                - from: "spring.application_name"
                  to: "service.name"

Thanks!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.