WARNING: Version 6.2 of Filebeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
logstash fields
editlogstash fields
editlogstash Module
logstash fields
editlog fields
editFields from the Logstash logs.
logstash.log.message
edittype: text
Contains the un-parsed log message
logstash.log.level
edittype: keyword
The log level of the message, this correspond to Log4j levels.
logstash.log.module
edittype: keyword
The module or class where the event originate.
logstash.log.thread
edittype: text
Information about the running thread where the log originate.
logstash.log.log_event
edittype: object
key and value debugging information.
slowlog fields
editslowlog
logstash.slowlog.message
edittype: text
Contains the un-parsed log message
logstash.slowlog.level
edittype: keyword
The log level of the message, this correspond to Log4j levels.
logstash.slowlog.module
edittype: keyword
The module or class where the event originate.
logstash.slowlog.thread
edittype: text
Information about the running thread where the log originate.
logstash.slowlog.event
edittype: text
Raw dump of the original event
logstash.slowlog.plugin_name
edittype: keyword
Name of the plugin
logstash.slowlog.plugin_type
edittype: keyword
Type of the plugin: Inputs, Filters, Outputs or Codecs.
logstash.slowlog.took_in_millis
edittype: long
Execution time for the plugin in milliseconds.
logstash.slowlog.took_in_nanos
edittype: long
Execution time for the plugin in nanoseconds.
logstash.slowlog.plugin_params
edittype: text
String value of the plugin configuration
logstash.slowlog.plugin_params_object
edittype: object
key → value of the configuration used by the plugin.