WARNING: Version 5.6 of Metricbeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« How Metricbeat Works Error Event Structure »
Elastic Docs ›Metricbeat Reference [5.6] ›How Metricbeat Works

Event Structure

edit

Event Structure

edit

Every event sent by Metricbeat has the same basic structure. It contains the following fields:

@timestamp
Time when the event was captured
beat.hostname
Hostname of the server on which the Beat is running
beat.name
Name given to the Beat
metricset.module
Name of the module that the data is from
metricset.name
Name of the metricset that the data is from
metricset.rtt
Round trip time of the request in microseconds
type
This is always "metricsets"

For example:

{
  "@timestamp": "2016-06-22T22:05:53.291Z",
  "beat": {
    "hostname": "host.example.com",
    "name": "host.example.com"
  },
  "metricset": {
    "module": "system",
    "name": "process",
    "rtt": 7419
  },
  .
  .
  .

  "type": "metricsets"
}

For more information about the exported fields, see Exported Fields.

« How Metricbeat Works Error Event Structure »