Event structure

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Event structure

edit

Every event sent by Metricbeat has the same basic structure. It contains the following fields:

@timestamp: Time when the event was captured
host.hostname: Hostname of the server on which the Beat is running
agent.type: Name given to the Beat
event.module: Name of the module that the data is from
event.dataset: Name of the module that the data is from

For example:

{
  "@timestamp": "2016-06-22T22:05:53.291Z",
  "agent": {
    "type": "metricbeat"
  },
  "host": {
     "hostname": "host.example.com",
   },
  "event": {
    "dataset": "system.process",
    "module": process
  },
  .
  .
  .

  "type": "metricsets"
}

For more information about the exported fields, see Exported fields.

« How Metricbeat works Error event structure »