I'd like to use the Logs UI for a bit more than plain syslog (e.g.,
Apache all the logs) however I can't get it to display anything other than a plain message field. This is not ideal when displaying non-syslog logs for more than one host as it's impossible to tell the source of an entry in the Logs UI if it doesn't contain the hostname. Even if you do identify an interesting log entry, you can't do anything with it as there's no interaction in the UI, so you need to go and find it again in the Discover tab.
I've tried playing with the setting
xpack.infra.sources.default.fields.message: ['message', '@message'] by adding extra fields but it doesn't have any effect whatsoever on the interface. In fact, this setting appears to be hard-coded, as even completely replacing the default fields does nothing to the interface (unless I'm misunderstanding its purpose).
So, is it possible to customise the output at all? Ideally I'd like to be able to set up a table of sorts, e.g.,
[timestamp], [hostname], [severity], [message] or variations on this depending on the log type.
Perhaps a setting like
xpack.infra.sources.default.fields.columns would allow people to format their own output by providing a list of event fields?
Also, are there any plans to add interactivity to this interface, (i.e., clickable log entries to create filters, etc.) At the moment it just seems to be a big combined tail of everything.