Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
Filebeat field "count" is created directly under the root of an event #778
When forwarding files with filebeat (1.0.1) to logstash, I see a new field called "count" that seems to always contain the value 1.
It would be great if this field could be moved into the beat section of an event, since it right now overlays a field that should be created by logstash.
Remark: I have seen this field on both linux and windows as well as on filebeat and topbeat.
This is what is coming out of logstash:
@kurromat Sorry for the late reply. I actually think this field is not necessary in filebeat and we can remove it.
@andrewkroh It is set here. Is there a reason we need it? https://github.com/elastic/beats/blob/master/filebeat/input/file.go#L67
All Beats have a
If we use count only for Packetbeat I would retest all dashboards to make sure nothing is broken. Using a "sum of count" aggregation is common in the dashboards from what I recall.