Graylog2 / Graylog2/graylog2-server

Beats type as prefix: Change default behavior to disable

Open
#6,068 5 comments 1 reaction 0 assignees View on GitHub
feature needs-discussion triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
The fields sent by the Beats agent should be sent as they are ingested rather than adding an annotation to the field name (prefix).

Unless the customer explicitly desires this behavior.

## Context
If I load a custom Beats configuration that normalized the data fields, or if I want to normalize my data based on the already standardized fields of the Beats agents, adding a prefix be default is not useful or desired.

This also incurs a higher metadata cost to the customer as the number of fields in a single message (especially for Winlogbeat) can be very numerous. Adding 7 bytes per field per message multiplied across the total number of logs can add up to a lot of data wasted.

## Your Environment

* Graylog Version:3.0.2
* Elasticsearch Version: 6.7.2
* MongoDB Version: 4.0.9
* Operating System: Linux (Whatever)
* Browser version: All of them

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.