Event structure

Every event sent by Metricbeat has the same basic structure. It contains the following fields:

@timestamp: Time when the event was captured
host.hostname: Hostname of the server on which the Beat is running
agent.type: Name given to the Beat
event.module: Name of the module that the data is from
event.dataset: Name of the module that the data is from

For example:

{
  "@timestamp": "2016-06-22T22:05:53.291Z",
  "agent": {
    "type": "metricbeat"
  },
  "host": {
     "hostname": "host.example.com",
   },
  "event": {
    "dataset": "system.process",
    "module": process
  },
  .
  .
  .

  "type": "metricsets"
}

For more information about the exported fields, see Exported fields.

« How Metricbeat works Error event structure »