In beats we try to provide an out of the box experience as much as possible in the scenario beats sending directly to Elasticsearch. Beats take care of any version upgrade, it make sure the index pattern is correct. The fields.yml is used to generate the elasticsearch JSON template.
Doing so allow us to create custom dashboard to visualize the information, because the fields will have the correct types.
When you are using Logstash, we consider this as a more advanced use case where user will either:
use the LS default dynamic template
create their own templates depending on the fields they have
will use a beat template as a starting point.
Concerning the point 3 and since you have custom fields you could use the command:
{beatname} export template > mytemplate.json
This will give you the template that the beat is using, you can modify it with your custom fields and push it to elasticsearch.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.