Docs
Metricbeat Reference [5.1] » How Metricbeat Works » Event Structure
«  How Metricbeat Works     Error Event Structure  »

Event Structureedit

Every event sent by Metricbeat has the same basic structure. It contains the following fields:

@timestamp
Time when the event was captured
beat.hostname
Hostname of the server on which the Beat is running
beat.name
Name given to the Beat
metricset.module
Name of the module that the data is from
metricset.name
Name of the metricset that the data is from
metricset.rtt
Round trip time of the request in microseconds
type
This is always "metricsets"

For example:

{
  "@timestamp": "2016-06-22T22:05:53.291Z",
  "beat": {
    "hostname": "host.example.com",
    "name": "host.example.com"
  },
  "metricset": {
    "module": "system",
    "name": "process",
    "rtt": 7419
  },
  .
  .
  .

  "type": "metricsets"
}

For more information about the exported fields, see Exported Fields .

«  How Metricbeat Works     Error Event Structure  »