Source missing in filebeat logs

Elastic Stack Beats
1

Hi Team ,

I have set up the filebeat to send the custom logs to Elasticsearch cluster, But there is "Source" missing on logs when I see them in Filebeat. I am using filebeat-8.7.0-1.x86_64 for sending the logs.
is this normal or am I missing something, Logs have not been very helpful. Can someone help me?

Regards
Vaibhav

2

Hi ,
is field "source" deprecated ?
Experts please help!

3

Hello,

It is not clear what is your issue, you need to provide more context. What is missing and where?

Please share some examples of what are you seeing and what you expected to see.

4

Thanks @leandrojmp for your reply.

there was no source field coming from Filebeat , which I was trying to use.
This stack flow question helped me to use log.file.path for my purpose. Just putting it over here for anyone who comes across same problem:
"How to get parts of Filebeat source filename in Logstash - Stack Overflow"

Thanks again

5

There is no source field since version 7.0, it was changed to log.file.path or log.source.address.

Were you following some tutorial that mentioned this field? I would recommend that when you follow some tutorial always check with the official documentation since the Elastic Stack has been changing a lot in the past years.

6

Thanks ! point taken.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.