Keep original log message when using Syslog input #15434
Labels
enhancement
Filebeat
Filebeat
Team:Integrations
Label for the Integrations team
triage_needed
[zube]: Inbox
Describe the enhancement:
When using the syslog input the original message is not stored in log.original. As processors run after the input parsing is completed you cannot use copy_field to get the original message back.
Describe a specific use case for the enhancement or feature:
Allow for reprocessing of syslogs in the future and allow for viewing the entire original log message.
The text was updated successfully, but these errors were encountered: