Skip to content

Filebeat modules: keep raw message #8083

@urso

Description

@urso

Filebeat modules parse and remove the original message. When original contents is JSON, the original message (as is), is not even published by filebeat. For debugging, re-processing, or just displaying original logs, filebeat should be able to publish the original unprocessed contents as well.

  • Add raw contents to log.message
  • Add option to modules to keep original message in log.message. Enabled by default (document this as backwards incompatible change)
  • Update json reader to also report original unparsed contents

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions