Log File Content Fields

edit

Contains log file lines.

source

edit

type: keyword

required: True

The file from which the line was read. This field contains the full path to the file. For example: /var/log/system.log.

offset

edit

type: long

required: False

The file offset the reported line starts at.

message

edit

type: text

required: True

The content of the line read from the log file.

type

edit

required: True

The name of the log event. This field is set to the value specified for the document_type option in the prospector section of the Filebeat config file.

input_type

edit

required: True

The input type from which the event was generated. This field is set to the value specified for the input_type option in the prospector section of the Filebeat config file.