Event structure [metricbeat-event-structure]

Every event sent by Metricbeat has the same basic structure. It contains the following fields:

@timestamp : Time when the event was captured

host.hostname : Hostname of the server on which the Beat is running

agent.type : Name given to the Beat

event.module : Name of the module that the data is from

event.dataset : Name of the source dataset in the format <module>.<metricset>

For example:

{
  "@timestamp": "2016-06-22T22:05:53.291Z",
  "agent": {
    "type": "metricbeat"
  },
  "host": {
     "hostname": "host.example.com",
   },
  "event": {
    "dataset": "system.process",
    "module": "system"
  },
  .
  .
  .

  "type": "metricsets"
}

For more information about the exported fields, see Exported fields.