Search code examples
elasticsearchelastic-stackfilebeat

Filebeat - what is the configuration json.message_key for?

I am working on a Filebeat project for indexing logs, in a Json format.

I see in the configuration that there is the option json.message_key: message

I don't really understand, what is this for, if I remove it, I see no change.

Can someone explain me ?

Logs are in this format :

{"appName" : "blala", "version" : "1.0.0", "level":"INFO", "message": "log message"}
Solution

  • Message is the default key for raw content line. So if you remove if from the config, filebeat will still use message, and apply grok on it.

    If you change it to "not-a-message", you should see a difference. But you should not do it as every automation depend on it.