This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« How Metricbeat works Error event structure »
Elastic Docs ›Metricbeat Reference [master] ›How Metricbeat works

Event structure

edit

Event structure

edit

Every event sent by Metricbeat has the same basic structure. It contains the following fields:

@timestamp
Time when the event was captured
host.hostname
Hostname of the server on which the Beat is running
agent.type
Name given to the Beat
event.module
Name of the module that the data is from
event.dataset
Name of the module that the data is from

For example:

{
  "@timestamp": "2016-06-22T22:05:53.291Z",
  "agent": {
    "type": "metricbeat"
  },
  "host": {
     "hostname": "host.example.com",
   },
  "event": {
    "dataset": "system.process",
    "module": process
  },
  .
  .
  .

  "type": "metricsets"
}

For more information about the exported fields, see Exported fields.

« How Metricbeat works Error event structure »