Event structure

Every event sent by Metricbeat has the same basic structure. It contains the following fields:

@timestamp
Time when the event was captured
host.hostname
Hostname of the server on which the Beat is running
agent.type
Name given to the Beat
event.module
Name of the module that the data is from
event.dataset
Name of the module that the data is from

For example:

{
  "@timestamp": "2016-06-22T22:05:53.291Z",
  "agent": {
    "type": "metricbeat"
  },
  "host": {
     "hostname": "host.example.com",
   },
  "event": {
    "dataset": "system.process",
    "module": process
  },
  .
  .
  .

  "type": "metricsets"
}

For more information about the exported fields, see Exported fields.