My log data contains several fields that Filebeat doesn’t know about in advance. ( eg: myapp.traceId, myapp.host.name etc. ). To avoid conflicts these are not directly root but under a root property "myapp".
Now, when I query explicitly as "myapp.traceId: abc123" , then this works BUT this does not work if
I query simply as "abc123".
I am trying to play around with this setting "setup.template.append_fields [experimental]"
Or do I need to add these properties to fields.yml or something else to get them included into "default_fields"
Appreciate the help