WARNING: Version 1.1 of Packetbeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Why doesn’t my connection to Logstash work? What is the difference between Logstash and Beats? »
Elastic Docs ›Packetbeat Reference [1.1] ›Troubleshooting ›Frequently Asked Questions

Why is @metadata missing in Logstash?

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Why is @metadata missing in Logstash?

edit

Logstash outputs remove @metadata fields automatically. Therefore, if Logstash instances are chained directly or via some message queue (for example, Redis or Kafka), the @metadata field will not be available in the final Logstash instance.

To preserve @metadata fields, use the Logstash mutate filter with the rename setting to rename the fields to non-internal fields.

« Why doesn’t my connection to Logstash work? What is the difference between Logstash and Beats? »