From 2dc4fe57a80df9ef2fc9d178c7a7435e3396228c Mon Sep 17 00:00:00 2001 From: bmorelli25 Date: Wed, 31 Jan 2024 13:20:51 -0800 Subject: [PATCH] =?UTF-8?q?timestamp=20req=E2=80=99d?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/en/observability/logs-plaintext.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/en/observability/logs-plaintext.asciidoc b/docs/en/observability/logs-plaintext.asciidoc index ad5c34d111..c97334af88 100644 --- a/docs/en/observability/logs-plaintext.asciidoc +++ b/docs/en/observability/logs-plaintext.asciidoc @@ -131,7 +131,7 @@ PUT _ingest/pipeline/filebeat* <1> <1> `_ingest/pipeline/filebeat*`: The name of the pipeline. Update the pipeline name to match the name of your data stream. For more information, refer to {fleet-guide}/data-streams.html#data-streams-naming-scheme[Data stream naming scheme]. <2> `processors.dissect`: Adds a {ref}/dissect-processor.html[dissect processor] to extract structured fields from your log message. <3> `field`: The field you're extracting data from, `message` in this case. -<4> `pattern`: The pattern of the elements in your log data. The pattern varies depending on your log format. `%{@timestamp}`, `%{log.level}`, `%{host.ip}`, and `%{message}` are common {ecs-ref}/ecs-reference.html[ECS] fields. This pattern would match a log file in this format: `2023-11-07T09:39:01.012Z ERROR 192.168.1.110 Server hardware failure detected.` +<4> `pattern`: The pattern of the elements in your log data. The pattern varies depending on your log format. `%{@timestamp}` is required. `%{log.level}`, `%{host.ip}`, and `%{message}` are common {ecs-ref}/ecs-reference.html[ECS] fields. This pattern would match a log file in this format: `2023-11-07T09:39:01.012Z ERROR 192.168.1.110 Server hardware failure detected.` Refer to <> for more on using ingest pipelines to parse your log data.