The tag "beats_input_codec_plain_applied" present in every document in Kibana

Question

I have set up the ELK stack with the version 7.2.0 : filebeat, logstash, elasticsearch & kibana.

When I send my logs to Kibana, I can see a tag "beats_input_codec_plain_applied" in every document.

I search through internet but there is no explanation about why this tag is added.

Answer 1

This seems to be undocumented, but this tag is added to every beats message by logstash beats input, it shows which codec was applied to the beats message, in your case it is the plain codec.

You can remove it in the logstash pipeline using a mutate filter.

mutate {
    remove_tag => ["beats_input_codec_plain_applied"]
} 

Or you can disable it in the input configuration by setting the option include_codec_tag to false.

input {
    beats {
        ... your beats input config ...
        include_codec_tag => false
    }
}