Filebeat field "count" is created directly under the root of an event #778
Description
When forwarding files with filebeat (1.0.1) to logstash, I see a new field called "count" that seems to always contain the value 1.
It would be great if this field could be moved into the beat section of an event, since it right now overlays a field that should be created by logstash.
Remark: I have seen this field on both linux and windows as well as on filebeat and topbeat.
This is what is coming out of logstash:
{
"message" => "2016-01-19 17:00:05,473 INFO loggingtext",
"@Version" => "1",
"@timestamp" => "2016-01-19T16:00:05.473Z",
"beat" => {
"hostname" => "somehostname",
"name" => "somehostname"
},
"count" => 1,
"fields" => {
"type" => "MyType"
},
"input_type" => "log",
"offset" => 28754,
"source" => [
[0] "MyFile"
],
"type" => "log",
"host" => "MyHost",
"MyAttribute" => "Content",
"tags" => [
[0] "MyTag"
]
}
Activity