I have log entries like
{"timeMillis":1545209409013,"thread":"ajp-bio-9003-exec-10","level":"INFO","loggerName":"com.company.Class","message":"Timeslot ID: null","endOfBatch":false,"loggerFqcn":"com.company.MyLogger","threadId":165,"threadPriority":5}
Filebeat is configured with fields_under_root: true
and it is shipping the json logs to LS
LS is filtering the log message and passing it to ES via
filter {
json {
source => message
}
}
The different fields (timemillis, thread, ..) are being added under root.
I would like now to prepend them with something like myApp.
(myApp.timemillis, etc)
How can I achieve this? Should I better do it in LS filters or is it possible to do it at Filebeat level?