Skip to content

Filebeat field "count" is created directly under the root of an event #778

Closed
@kurromat

Description

When forwarding files with filebeat (1.0.1) to logstash, I see a new field called "count" that seems to always contain the value 1.

It would be great if this field could be moved into the beat section of an event, since it right now overlays a field that should be created by logstash.

Remark: I have seen this field on both linux and windows as well as on filebeat and topbeat.

This is what is coming out of logstash:

{
"message" => "2016-01-19 17:00:05,473 INFO loggingtext",
"@Version" => "1",
"@timestamp" => "2016-01-19T16:00:05.473Z",
"beat" => {
"hostname" => "somehostname",
"name" => "somehostname"
},
"count" => 1,
"fields" => {
"type" => "MyType"
},
"input_type" => "log",
"offset" => 28754,
"source" => [
[0] "MyFile"
],
"type" => "log",
"host" => "MyHost",
"MyAttribute" => "Content",
"tags" => [
[0] "MyTag"
]
}

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions