Reason to keep message field?

Elastic Stack Elasticsearch
1

Collecting windows logs via winlogbeats, removing the message field via logstash before the output phase, so far my daily beats shards are 80% smaller.

With all of the fields parsed and indexed correctly are there any reasons to keep the message field?

Thanks
Phil

2

one reason I can think of is to enable auditing, in case something goes wrong with the parsing in the future

3

Thanks, i will take that into account, the logs in question would be windows logs from winlogbeat using ECS. Other logs i currently remove the message if there are no grok failures.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.