Is the default Filebeat output name for log lines "message"? Can I give it a different name by configuring filebeat.yml, instead of using the rename processor in ingest node?
Also, can I change the default "source" field (file path, not "_source") name?
Yes
No, you need to use ingest node or Logstash to rename fields.
Ditto
Thank you, Andrew.
This topic was automatically closed after 21 days. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.