I’m using graylog with beats input and
journalbeat container to send logs from systemd journal to graylog.
The thing is that there are a lot of fields (the majority of them) that graylog is showing as
beat_journal_fieldname (see the image bellow).
I’d like to rename them to only
How can I check if it is
journalbeat that is sending it like that, or if it is graylog that is renaming the fields?