Rename default output field names

Elastic Stack Beats
1

Is the default Filebeat output name for log lines "message"? Can I give it a different name by configuring filebeat.yml, instead of using the rename processor in ingest node?

Also, can I change the default "source" field (file path, not "_source") name?

2

Yes

No, you need to use ingest node or Logstash to rename fields.

Ditto

1 Like
3

Thank you, Andrew.

4

This topic was automatically closed after 21 days. New replies are no longer allowed.