From 29a8ee8031c450896c761936707ab1a93dfe257e Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Thu, 11 Mar 2021 20:27:17 -0800 Subject: [PATCH] Move example to the correct location in reference docs (#24455) (#24481) --- .../filebeat/docs/inputs/input-aws-s3.asciidoc | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc b/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc index fde7f734d6cd..5d10e07a04e2 100644 --- a/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc +++ b/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc @@ -45,6 +45,15 @@ call will be interrupted. The default AWS API call timeout for a message is 120 seconds. The minimum is 0 seconds. The maximum is half of the visibility timeout value. +[float] +==== `expand_event_list_from_field` + +If the fileset using this input expects to receive multiple messages bundled +under a specific field then the config option expand_event_list_from_field value +can be assigned the name of the field. This setting will be able to split the +messages under the group value into separate events. For example, CloudTrail logs +are in JSON format and events are found under the JSON object "Records". + ["source","json"] ---- { @@ -65,15 +74,6 @@ is 0 seconds. The maximum is half of the visibility timeout value. } ---- -[float] -==== `expand_event_list_from_field` - -If the fileset using this input expects to receive multiple messages bundled -under a specific field then the config option expand_event_list_from_field value -can be assigned the name of the field. This setting will be able to split the -messages under the group value into separate events. For example, CloudTrail logs -are in JSON format and events are found under the JSON object "Records". - Note: When `expand_event_list_from_field` parameter is given in the config, aws-s3 input will assume the logs are in JSON format and decode them as JSON. Content type will not be checked.