Currently metricbeat or filebeat report errors as a message under the error field in the event:

{
    "error": "Hello world error"
}

This worked well so far but has its limitations. It's hard to find all errors of one type because messages can change over time and it is tricky to filter by it.

Inspired by the hearbeat error format (see #3406) I suggest for 6.0 we enhance and unify the error format across all beats:

"error": {
	"message": "Hello world",			(text)
	"level": "warning",				(keyword)
	"type": "io",					(keyword
	"code": 404,					(long)
}

The above allows errors to add more meta data. The code can be used to introduce certain errors codes and the level can be used to define the "severity" of an error so people can filter based on it.

By default, all current error fields will go into error.message in the future.

The above is a breaking change and it must be ensured that 5.x and 6.x beats data will not go into the same index. This should be solved through the beats index versioning.