elastic / elastic/beats

[Filebeat] Include input metadata in logs

Open
#45,377 2 comments 0 reactions 1 assignee Claimed by @taylor-swanson View on GitHub
enhancement Filebeat Team:Security-Deployment and Devices wg:wmd
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

## Overview

For loggers in inputs, additional metadata should be added to enrich logs about the input type, id, and any other attribute that would be necessary for identifying/filtering logs in Kibana, namely the Agent Logs UI.

This issue builds off the proposal in [this RFC](https://docs.google.com/document/d/1hE16KZmGryoINPB2hzLgiL48iEZSgNehoc2RPd1vBe4/edit?tab=t.0). While the RFC proposed extending the `unit.*` fields, it would be better to add to the existing input.* fields.

Proposed fields:

- `input.type`
- `input.id`
- `input.name`

## Problems

Elastic Agent uses filestream to read Filebeat logs and `input.type` is always overridden with `filestream`

## Related Issues
- Relates elastic/integration-experience#32

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.