The system-logs input is a "proxy input" that decides whether journald or log should be used as input for Filebeat's system module. At the moment of writing it is intended to be used only by the system integraiton.
One problem with the current implementation is that the input.type set in the event is system-logs instead of the actual name of the input running/collecting the data.
As a quick fix, we're overwriting input.type using ES ingest pipelines, however this is not ideal. This issue is about finding a way to get this fixed within Filebeat and have input.type correctly set.
The
system-logs
input is a "proxy input" that decides whetherjournald
orlog
should be used as input for Filebeat's system module. At the moment of writing it is intended to be used only by the system integraiton.One problem with the current implementation is that the
input.type
set in the event issystem-logs
instead of the actual name of the input running/collecting the data.As a quick fix, we're overwriting
input.type
using ES ingest pipelines, however this is not ideal. This issue is about finding a way to get this fixed within Filebeat and haveinput.type
correctly set.