Logstash fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
logstash Module
Fields from the Logstash logs.
logstash.log.module-
The module or class where the event originate.
type: keyword
logstash.log.thread-
Information about the running thread where the log originate.
type: keyword
logstash.log.thread.text- type: text
logstash.log.log_event-
key and value debugging information.
type: object
logstash.log.log_event.action- type: keyword
logstash.log.pipeline_id-
The ID of the pipeline.
type: keyword
example: main
logstash.log.message-
type: alias
alias to: message
logstash.log.level-
type: alias
alias to: log.level
slowlog
logstash.slowlog.module-
The module or class where the event originate.
type: keyword
logstash.slowlog.thread-
Information about the running thread where the log originate.
type: keyword
logstash.slowlog.thread.text- type: text
logstash.slowlog.event-
Raw dump of the original event
type: keyword
logstash.slowlog.event.text- type: text
logstash.slowlog.plugin_name-
Name of the plugin
type: keyword
logstash.slowlog.plugin_type-
Type of the plugin: Inputs, Filters, Outputs or Codecs.
type: keyword
logstash.slowlog.took_in_millis-
Execution time for the plugin in milliseconds.
type: long
logstash.slowlog.plugin_params-
String value of the plugin configuration
type: keyword
logstash.slowlog.plugin_params.text- type: text
logstash.slowlog.plugin_params_object-
key -> value of the configuration used by the plugin.
type: object
logstash.slowlog.level-
type: alias
alias to: log.level
logstash.slowlog.took_in_nanos-
type: alias
alias to: event.duration