WARNING: Version 1.2 of Filebeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Common Fields Regular Expression Support »
Elastic Docs ›Filebeat Reference [1.2] ›Reference ›Exported Fields

Log File Content Fields

edit

Log File Content Fields

edit

Contains log file lines.

source

edit

type: string

required: True

The file from which the line was read. This field contains the full path to the file. For example: /var/log/system.log.

offset

edit

type: long

required: False

The file offset the reported line starts at.

message

edit

type: string

required: True

The content of the line read from the log file.

fields

edit

type: dict

required: False

Contains user configurable fields.

« Common Fields Regular Expression Support »