Skip to content

Commit

Permalink
Clarify that json.message_key is optional in Filebeat
Browse files Browse the repository at this point in the history
I reordered the options based on importance (I put the optional config setting at the end).

And I changed the wording to further clarify that the `json.message_key` setting is optional.

Fixes elastic#2864
  • Loading branch information
andrewkroh committed Nov 23, 2016
1 parent 104563d commit dadadfd
Showing 1 changed file with 9 additions and 7 deletions.
16 changes: 9 additions & 7 deletions filebeat/docs/reference/configuration/filebeat-options.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -320,24 +320,26 @@ Example configuration:

[source,yaml]
-------------------------------------------------------------------------------------
json.message_key: log
json.keys_under_root: true
json.add_error_key: true
json.message_key: log
-------------------------------------------------------------------------------------


*`message_key`*:: JSON key on which to apply the line filtering and multiline settings. This key must be top level
and its value must be string, otherwise it is ignored. If no text key is defined, the line
filtering and multiline features cannot be used.

*`keys_under_root`*:: By default, the decoded JSON is placed under a "json" key in the output document.
If you enable this setting, the keys are copied top level in the output document. The default is false.

*`overwrite_keys`*:: If `keys_under_root` and this setting are enabled, then the values from the decoded
JSON object overwrite the fields that Filebeat normally adds (type, source, offset, etc.) in case of conflicts.

*`add_error_key`*:: If this setting is enabled, Filebeat adds a "json_error" key in case of JSON
unmarshaling errors or when a text key is defined in the configuration but cannot be used.
unmarshalling errors or when a `message_key` is defined in the configuration but cannot be used.

*`message_key`*:: An optional configuration setting that specifies a JSON key on
which to apply the line filtering and multiline settings. If specified the
key must be at the top level in the JSON object and the value associated with
the key must be a string, otherwise no filtering or multiline aggregation will
occur.


[[multiline]]
===== multiline
Expand Down

0 comments on commit dadadfd

Please sign in to comment.