diff --git a/infrastructure/monitoring/logstash/logstash.conf b/infrastructure/monitoring/logstash/logstash.conf index f71eb84d..dfc86621 100644 --- a/infrastructure/monitoring/logstash/logstash.conf +++ b/infrastructure/monitoring/logstash/logstash.conf @@ -9,7 +9,10 @@ filter { # Docker's GELF driver want's to write into a field named # container_id, but Kibana and other tools read from container.id by default rename => {"container_id" => "container.id"} + # As of V8, Elasticsearch JSON logs now comply with ECS. [host] becomes object + rename => {"[host]" => "[host][name]"} } + truncate { length_bytes => 12 fields => ["container.id"]