I am pulling access logs from 2 machines (BPM00, BPM01) via filebeat as log shipper everything was fine until yesterday the logs.
In below image
I have applied filters avaeragetime, path, source, host.
In this the host field was the location from where logs have been forwarding from filebeat but now there's a new path field which has the location only for BPM00 machine and it has the tags field
tags access_logs, _grokparsefailure
for the BPM01 machine location is source and there is no grok failure
Am wondering how this path field got added!