WARNING: Version 1.2 of Filebeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Common Fields
editCommon Fields
editContains common fields available in all event types.
beat.name
editThe name of the Beat sending the log messages. If the shipper name is set in the configuration file, then that value is used. If it is not set, the hostname is used. To set the shipper name, use the name option in the shipper section of the configuration file.
beat.hostname
editThe hostname as returned by the operating system on which the Beat is running.
@timestamp
edittype: date
example: 2015-01-24 14:06:05.071000
format: YYYY-MM-DDTHH:MM:SS.milliZ
required: True
The timestamp when the log line was read. The precision is in milliseconds. The timezone is UTC.
type
editrequired: True
The name of the log event. This field is set to the value specified for the document_type option in the prospector section of the Filebeat config file.
input_type
editrequired: True
The input type from which the event was generated. This field is set to the value specified for the input_type option in the prospector section of the Filebeat config file.