
////
This file is generated! See etc/fields.yml and scripts/generate_field_docs.py
////

[[exported-fields]]
= Exported Fields

[partintro]

--
This document describes the fields that are exported by Filebeat. They are
grouped in the following categories:

* <<exported-fields-beat>>
* <<exported-fields-log>>

--
[[exported-fields-beat]]
== Beat Fields

Contains common beat fields available in all event types.



[float]
=== beat.name

The name of the Beat sending the log messages. If the Beat name is set in the configuration file, then that value is used. If it is not set, the hostname is used. To set the Beat name, use the `name` option in the configuration file.


[float]
=== beat.hostname

The hostname as returned by the operating system on which the Beat is running.


[float]
=== @timestamp

type: date

example: August 26th 2016, 12:35:53.332

format: date

required: True

The timestamp when the event log record was generated.


[float]
=== tags

Arbitrary tags that can be set per Beat and per transaction type.


[float]
=== fields

type: dict

Contains user configurable fields.


[[exported-fields-log]]
== Log File Content Fields

Contains log file lines.



[float]
=== source

type: keyword

required: True

The file from which the line was read. This field contains the full path to the file. For example: `/var/log/system.log`.


[float]
=== offset

type: long

required: False

The file offset the reported line starts at.


[float]
=== message

type: text

required: True

The content of the line read from the log file.


[float]
=== type

required: True

The name of the log event. This field is set to the value specified for the `document_type` option in the prospector section of the Filebeat config file.


[float]
=== input_type

required: True

The input type from which the event was generated. This field is set to the value specified for the `input_type` option in the prospector section of the Filebeat config file.


