Graylog2 / Graylog2/graylog2-server
Beats type as prefix: Change default behavior to disable
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
The fields sent by the Beats agent should be sent as they are ingested rather than adding an annotation to the field name (prefix).
Unless the customer explicitly desires this behavior.
## Context
If I load a custom Beats configuration that normalized the data fields, or if I want to normalize my data based on the already standardized fields of the Beats agents, adding a prefix be default is not useful or desired.
This also incurs a higher metadata cost to the customer as the number of fields in a single message (especially for Winlogbeat) can be very numerous. Adding 7 bytes per field per message multiplied across the total number of logs can add up to a lot of data wasted.
## Your Environment
* Graylog Version:3.0.2
* Elasticsearch Version: 6.7.2
* MongoDB Version: 4.0.9
* Operating System: Linux (Whatever)
* Browser version: All of them
Contributor guide
Assessment
This issue has not been assessed yet.