I've updated everything to the latest versions (logstash, elasticsearch, filebeat, kibana) and I see this tag added to every document: beats_input_codec_plain_applied
Everything looks to be working but what does this mean and do I care?
It's some extra tag added by the logstash input plugin after reading the 'message' field from filebeat, but no idea what this is good for. Maybe for debugging. Maybe you can ask in logstash forum.
Thanks, asked.