Log file content fields
editLog file content fields
editContains log file lines.
-
source -
type: keyword
required: True
The file from which the line was read. This field contains the absolute path to the file. For example:
/var/log/system.log. -
offset -
type: long
required: False
The file offset the reported line starts at.
-
message -
type: text
required: True
The content of the line read from the log file.
-
stream -
type: keyword
required: False
Log stream when reading container logs, can be stdout or stderr
-
prospector.type -
required: True
The input type from which the event was generated. This field is set to the value specified for the
typeoption in the input section of the Filebeat config file. (DEPRECATED: seeinput.type) -
input.type -
required: True
The input type from which the event was generated. This field is set to the value specified for the
typeoption in the input section of the Filebeat config file. -
read_timestamp -
In case the ingest pipeline parses the timestamp from the log contents, it stores the original
@timestamp(representing the time when the log line was read) in this field. -
fileset.module -
The Filebeat module that generated this event.
-
fileset.name -
The Filebeat fileset that generated this event.
-
syslog.facility -
type: long
required: False
The facility extracted from the priority.
-
syslog.priority -
type: long
required: False
The priority of the syslog event.
-
syslog.severity_label -
type: keyword
required: False
The human readable severity.
-
syslog.facility_label -
type: keyword
required: False
The human readable facility.
-
process.program -
type: keyword
required: False
The name of the program.
-
process.pid -
type: long
required: False
The pid of the process.
-
event.severity -
type: long
required: False
The severity of the event.