Simplifying Filebeat JSON Output Format

Elastic Stack Beats
1

Hello,

I am new working with Filebeat and think it is a wonderful tool. I am currently using it to replace a tool that pushes weblogs to Kafka, and I want to just pass the "message" through without the other values. Is this possible?

Thanks!

2

You can use the include_fields filter.

filter:
 - include_fields.fields: ["message"]

That will leave message, type, and @timestamp in the event.

1 Like
3

Thanks Andrew! That answers my question.I was hoping to just push the single field as my consumer has no use for the timestamp or type fields but this does get me mostly there..