This documentation https://www.elastic.co/guide/en/beats/filebeat/5.2/logstash-output.html causes confusion in the role of the setting "index" , this might be a mistake in the doc due to differences of this setting between when it's used inlogstash-output versus when it's used in elasticsearch-output.
The document flow seems to also cause confusion as it starts with logstash configuration details.
The "index" option is passed to the Logstash metadata, and can be used in the LS elasticsearch output (that's the purpose of the LS configuration samples). The docs should definitely be clarified.
The document flow seems to also cause confusion as it starts with logstash configuration details.
Pinging @dedemorton for this one :)
I think we should also make it more clear that metadata fields are not part of the event at output time.
E.g. if you are doing something like Filebeat -> LS1 -> Redis -> LS2.
The meta data fields populated by Filebeat are only existent onLS1 and will not be passed to Redis, thus also missing in LS2 unless copied to a normal field via mutate or something in LS1.
Resolved in #3866
Most helpful comment
I think we should also make it more clear that metadata fields are not part of the event at output time.
E.g. if you are doing something like
Filebeat -> LS1 -> Redis -> LS2.The meta data fields populated by Filebeat are only existent on
LS1and will not be passed toRedis, thus also missing inLS2unless copied to a normal field via mutate or something inLS1.