Starting in version 7.16, this experimental functionality has been removed. You should use the journald input in Filebeat instead.

« Cloud provider metadata fields Docker fields »

› ›

Common Journalbeat fields

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Common Journalbeat fields

edit

Contains common fields available in all event types.

coredump

edit

Fields used by systemd-coredump kernel helper.

coredump.unit

Annotations of messages containing coredumps from system units.

type: keyword

coredump.user_unit

Annotations of messages containing coredumps from user units.

type: keyword

journald

edit

Fields provided by journald.

object

edit

Fields to log on behalf of a different program.

audit

edit

Audit fields of event.

journald.object.audit.login_uid

The login UID of the object process.

type: long

example: 1000

required: False

journald.object.audit.session

The audit session of the object process.

type: long

example: 3

required: False

journald.object.process.command_line

The command line of the process.

type: keyword

example: /lib/systemd/systemd --user

required: False

journald.object.process.name

Name of the executable.

type: keyword

example: /lib/systemd/systemd

required: False

journald.object.process.executable

Path to the the executable.

type: keyword

example: /lib/systemd/systemd

required: False

journald.object.uid

UID of the object process.

type: long

required: False

journald.object.gid

GID of the object process.

type: long

required: False

journald.object.pid

PID of the object process.

type: long

required: False

systemd

edit

Systemd fields of event.

journald.object.systemd.owner_uid

The UID of the owner.

type: long

required: False

journald.object.systemd.session

The ID of the systemd session.

type: keyword

required: False

journald.object.systemd.unit

The name of the systemd unit.

type: keyword

required: False

journald.object.systemd.user_unit

The name of the systemd user unit.

type: keyword

required: False

kernel

edit

Fields to log on behalf of a different program.

journald.kernel.device

The kernel device name.

type: keyword

required: False

journald.kernel.subsystem

The kernel subsystem name.

type: keyword

required: False

journald.kernel.device_symlinks

Additional symlink names pointing to the device node in /dev.

type: keyword

required: False

journald.kernel.device_node_path

The device node path of this device in /dev.

type: keyword

required: False

journald.kernel.device_name

The kernel device name as it shows up in the device tree below /sys.

type: keyword

required: False

code

edit

Fields of the code generating the event.

journald.code.file

The name of the source file where the log is generated.

type: keyword

example: ../src/core/manager.c

required: False

journald.code.function

The name of the function which generated the log message.

type: keyword

example: job_log_status_message

required: False

journald.code.line

The line number of the code which generated the log message.

type: long

example: 123

required: False

process

edit

Fields to log on behalf of a different program.

audit

edit

Audit fields of event.

journald.process.audit.loginuid

The login UID of the source process.

type: long

example: 1000

required: False

journald.process.audit.session

The audit session of the source process.

type: long

example: 3

required: False

journald.process.command_line

The command line of the process.

type: keyword

example: /lib/systemd/systemd --user

required: False

journald.process.name

Name of the executable.

type: keyword

example: /lib/systemd/systemd

required: False

journald.process.executable

Path to the the executable.

type: keyword

example: /lib/systemd/systemd

required: False

journald.process.pid

The ID of the process which logged the message.

type: long

example: 1

required: False

journald.process.gid

The ID of the group which runs the process.

type: long

example: 1

required: False

journald.process.uid

The ID of the user which runs the process.

type: long

example: 1

required: False

journald.process.capabilites

The effective capabilites of the process.

required: False

systemd

edit

Fields of systemd.

systemd.invocation_id

The invocation ID for the runtime cycle of the unit the message was generated in.

type: keyword

example: 8450f1672de646c88cd133aadd4f2d70

required: False

systemd.cgroup

The control group path in the systemd hierarchy.

type: keyword

example: /user.slice/user-1234.slice/session-2.scope

required: False

systemd.owner_uid

The owner UID of the systemd user unit or systemd session.

type: long

required: False

systemd.session

The ID of the systemd session.

type: keyword

required: False

systemd.slice

The systemd slice unit.

type: keyword

example: user-1234.slice

required: False

systemd.user_slice

The systemd user slice unit.

type: keyword

required: False

systemd.unit

The name of the systemd unit.

type: keyword

example: nginx.service

required: False

systemd.user_unit

The name of the systemd user unit.

type: keyword

example: user-1234.slice

required: False

systemd.transport

How the log message was received by journald.

type: keyword

example: syslog

required: True

host

edit

Fields of the host.

host.boot_id

The boot ID for the boot the log was generated in.

type: keyword

example: dd8c974asdf01dbe2ef26d7fasdf264c9

required: False

syslog

edit

Fields of the code generating the event.

syslog.priority

The priority of the message. A syslog compatibility field.

type: long

example: 1

required: False

syslog.facility

The facility of the message. A syslog compatibility field.

type: long

example: 1

required: False

syslog.identifier

The identifier of the message. A syslog compatibility field.

type: keyword

example: su

required: False

custom

Arbitrary fields coming from processes.

type: nested

required: False

read_timestamp

type: alias

alias to: event.created

container.log.tag

User defined tag of a container.

type: keyword

« Cloud provider metadata fields Docker fields »