I have set up the ELK stack with the version 7.2.0 : filebeat, logstash, elasticsearch & kibana.
When I send my logs to Kibana, I can see a tag "beats_input_codec_plain_applied" in every document.
I search through internet but there is no explanation about why this tag is added.
This seems to be undocumented, but this tag is added to every beats message by logstash beats
input, it shows which codec was applied to the beats message, in your case it is the plain
codec.
You can remove it in the logstash pipeline using a mutate
filter.
mutate {
remove_tag => ["beats_input_codec_plain_applied"]
}
Or you can disable it in the input configuration by setting the option include_codec_tag
to false
.
input {
beats {
... your beats input config ...
include_codec_tag => false
}
}