filebeat: prospectors: paths: - /var/log/foo.log fields: type: foo output: logstash: [...] --------> { "message" => "1444636537.881", "@version" => "1", "@timestamp" => "2015-11-02T23:43:39.881Z", "type" => "log", "count" => 1, "fields" => { "type" => "foo" }, "fileinfo" => {}, "line" => 14158, "offset" => 381315, "source" => "/var/log/foo", [...] }