- Filebeat Reference: other versions:
- Overview
- Getting Started With Filebeat
- Upgrading Filebeat
- How Filebeat Works
- Configuring Filebeat
- Configuration Options (Reference)
- Filebeat Prospectors Configuration
- Filebeat Global Configuration
- General Configuration
- Elasticsearch Output Configuration
- Logstash Output Configuration
- Kafka Output Configuration
- Redis Output Configuration
- File Output Configuration
- Console Output Configuration
- SSL Configuration
- Paths Configuration
- Logging Configuration
- Processors
- Filtering and Enhancing the Exported Data
- Managing Multiline Messages
- Configuring Filebeat to Use Ingest Node
- Using Environment Variables in the Configuration
- Specifying Multiple Prospectors
- Load Balancing
- YAML Tips and Gotchas
- Regular Expression Support
- Configuration Options (Reference)
- Exported Fields
- Securing Filebeat
- Troubleshooting
- Migrating from Logstash Forwarder to Filebeat
WARNING: Version 5.1 of Filebeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Log File Content Fields
editLog File Content Fields
editContains log file lines.
source
edittype: keyword
required: True
The file from which the line was read. This field contains the full path to the file. For example: /var/log/system.log.
offset
edittype: long
required: False
The file offset the reported line starts at.
message
edittype: text
required: True
The content of the line read from the log file.
type
editrequired: True
The name of the log event. This field is set to the value specified for the document_type option in the prospector section of the Filebeat config file.
input_type
editrequired: True
The input type from which the event was generated. This field is set to the value specified for the input_type option in the prospector section of the Filebeat config file.
On this page