---
title: Cilium Tetragon Integration for Elastic
description: The Cilium Tetragon integration for Elastic enables you to monitor and analyze events from Tetragon, a Kubernetes-aware security observability and runtime...
url: https://www.elastic.co/docs/reference/integrations/cilium_tetragon
products:
- Elastic integrations
applies_to:
- Serverless Observability projects: Preview
- Serverless Security projects: Preview
- Elastic Stack: Preview since 9.0
---
# Cilium Tetragon Integration for Elastic
| | |
|-------------------------------------------------------------------------------------------------|-------------------------------------------------------------------|
| **Version** | 0.4.1 : Preview ([View all](#changelog)) |
| **Subscription level**[What's this?](https://www.elastic.co/subscriptions) | Basic |
| **Developed by**[What's this?](https://www.elastic.co/docs/reference/integrations/developed-by) | Elastic |
| **Minimum Kibana version(s)** | 9.0.08.13.0 |
To use pre-release integrations, go to the **Integrations** page in Kibana, scroll down, and toggle on the _Display beta integrations_ option.
## Overview
The Cilium Tetragon integration for Elastic enables you to monitor and analyze events from [Tetragon](https://tetragon.io/), a Kubernetes-aware security observability and runtime enforcement tool supported by the Cloud Native Computing Foundation (CNCF). This integration provides granular visibility into the internal workings of your Kubernetes clusters by collecting security event logs, allowing you to visualize data in Kibana, set up alerts, and respond to security events in real time.
### Compatibility
This integration is compatible with Cilium Tetragon running in Kubernetes environments. It has been specifically tested and validated using a sidecar deployment pattern.
### How it works
This integration works by collecting JSON-formatted event logs generated by the Cilium Tetragon agent. You typically deploy a Filebeat sidecar container that reads these logs from a shared volume and forwards them to your Elastic deployment. The integration then processes and indexes the logs through the `log` data stream, making them available for analysis in Kibana. This approach leverages eBPF technology to provide deep runtime security observability and enforcement without requiring changes to your application code.
## What data does this integration collect?
The Cilium Tetragon integration collects runtime security events and system-level telemetry from your Kubernetes clusters using eBPF-based monitoring.
The integration collects log messages of the following types in the `log` data stream:
- Security event logs: Comprehensive runtime security events from the Tetragon agent.
- Process metadata: Detailed information regarding process execution, including binary paths, PIDs, and parent-child relationships.
- Network logs: Connectivity data including source/destination IPs, ports, and protocol-specific details for cluster traffic.
- System call information: Detailed logs of system calls monitored by Tetragon's eBPF-based enforcement engine.
### Supported use cases
Integrating Cilium Tetragon logs with Elastic provides visibility and security monitoring for containerized environments. You can use this integration for the following use cases:
- Kubernetes security observability: Monitor and analyze security events from applications running in Kubernetes to gain visibility into process executions and kernel-level activities.
- Runtime threat detection: Detect and respond to security threats by analyzing process behavior, file access patterns, and system call activities.
- Compliance and audit logging: Capture detailed audit trails of process lifecycle events and system activities with full Kubernetes context for forensic analysis and regulatory requirements.
- Container security monitoring: Track process lifecycle events within containers and correlate security events with Kubernetes workload types, namespaces, and labels.
## What do I need to use this integration?
To use this integration, you'll need the following environment and vendor-specific components:
- A running Kubernetes cluster with nodes that support eBPF.
- Helm v3 installed and configured locally to manage the Tetragon deployment.
- `kubectl` access with `cluster-admin` or equivalent permissions to create Role-Based Access Control (RBAC) resources, DaemonSets, and ConfigMaps in the `kube-system` namespace.
- Permission to run containers with `privileged: true` or specific capabilities like `CAP_SYS_ADMIN`, and the sidecar collector with `runAsUser: 0`.
You also need the following Elastic Stack components:
- Elastic Stack version 8.13.0 or later.
- The Cilium Tetragon integration assets installed in Kibana.
- Elasticsearch credentials with permissions to create and write to indices.
- Outbound network connectivity from Kubernetes nodes to the Elasticsearch cluster, typically on port `443` or `9200`.
## How do I deploy this integration?
This integration uses a Filebeat sidecar approach to collect logs from Kubernetes environments and send them to Elastic using a cloud-native design.
Elastic Agent is not used to collect data for this integration. Instead, you'll install the integration assets in Kibana to provide the necessary ingest pipelines and dashboards, then configure Tetragon to export logs to Elasticsearch using a Filebeat sidecar.
### Set up steps in Cilium Tetragon
To set up Cilium Tetragon to send data to Elastic, you'll need to configure a Filebeat sidecar and update your Tetragon deployment. Follow these steps to configure the system:
1. Create a Filebeat ConfigMap to define the log processing logic. Save the following content as `filebeat-config.yaml`, ensuring you update the connection details:
```yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-configmap
namespace: kube-system
data:
filebeat.yml: |
filebeat.inputs:
- type: filestream
id: tetragon-log
enabled: true
paths:
- /var/run/cilium/tetragon/*.log
path.data: /usr/share/filebeat/data
processors:
- timestamp:
field: "time"
layouts:
- '2006-01-02T15:04:05Z'
- '2006-01-02T15:04:05.999Z'
- '2006-01-02T15:04:05.999-07:00'
test:
- '2019-06-22T16:33:51Z'
- '2019-11-18T04:59:51.123Z'
- '2020-08-03T07:10:20.123456+02:00'
setup.template.name: logs
setup.template.pattern: "logs-cilium_tetragon.*"
output.elasticsearch:
hosts: ["https://<> (replace with your actual value)"]
username: "<> (replace with your actual value)"
password: "<> (replace with your actual value)"
index: logs-cilium_tetragon.log-default
```
2. Apply the configuration to your cluster:
```bash
kubectl apply -f filebeat-config.yaml
```
3. Create a `filebeat-helm-values.yaml` file to enable JSON export and inject the sidecar container into the Tetragon pods, replacing the image with your stack version tag:
```yaml
export:
securityContext:
runAsUser: 0
runAsGroup: 0
stdout:
enabledCommand: false
enabledArgs: false
image:
override: "docker.elastic.co/beats/filebeat:<>"
extraVolumeMounts:
- name: filebeat-config
mountPath: /usr/share/filebeat/filebeat.yml
subPath: filebeat.yml
- name: filebeat-data
mountPath: /usr/share/filebeat/data
extraVolumes:
- name: filebeat-data
hostPath:
path: /var/run/cilium/tetragon/filebeat
type: DirectoryOrCreate
- name: filebeat-config
configMap:
name: filebeat-configmap
items:
- key: filebeat.yml
path: filebeat.yml
```
4. Deploy or update Tetragon using Helm with your override file:
```bash
helm repo add cilium https://helm.cilium.io
helm repo update
helm install tetragon -f filebeat-helm-values.yaml cilium/tetragon -n kube-system
```
#### Vendor resources
For more information on configuring Tetragon, refer to the following resources:
- [Tetragon | Deploy on Kubernetes](https://tetragon.io/docs/installation/kubernetes/)
- [Tetragon Helm Chart Reference](https://tetragon.io/docs/reference/helm-chart/)
### Set up steps in Kibana
To install the necessary assets for the Cilium Tetragon integration, follow these steps:
1. In Kibana, navigate to **Management > Integrations**.
2. Search for and select **Cilium Tetragon**.
3. Click **Add Cilium Tetragon**.
4. Follow the prompts to install the integration assets. You must select **Add Integration Only** to install dashboards and pipelines without enrolling an Elastic Agent, as this integration uses the Filebeat sidecar.
5. Configure the general integration settings:
- Integration name: A unique name for this integration instance (e.g., `tetragon-kubernetes`).
- Namespace: The namespace where data will be indexed (e.g., `default`).
6. Click **Save and continue**.
### Validation
To verify that the integration is working properly and data is flowing into Elasticsearch, follow these steps:
1. Check that the Tetragon pods are running in the `kube-system` namespace:
```bash
kubectl get pods -n kube-system -l app.kubernetes.io/name=tetragon
```
2. Trigger a Tetragon event by running a command inside any pod in your cluster which will trigger a Tetragon event. The actions required will depend on your configured Tetragon policies.
3. In Kibana, navigate to **Analytics > Discover**.
4. Select the `logs-*` data view and enter the following KQL filter to verify logs appear: `data_stream.dataset : "cilium_tetragon.log"`.
5. Confirm that events contain expected fields such as `event.dataset` and `event.action`.
6. Navigate to **Analytics > Dashboards** and search for "Cilium Tetragon" to view the pre-built visualizations.
## Troubleshooting
For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems).
### Common configuration issues
This integration involves several components within your Kubernetes cluster. If you encounter issues, review these common scenarios:
- No data appearing in Elasticsearch after installation:
- Verify that the Filebeat ConfigMap was created successfully using `kubectl get configmap -n kube-system filebeat-configmap`.
- Check Tetragon pod logs for errors using `kubectl logs -n kube-system `.
- Verify the Filebeat sidecar is running and exporting logs using `kubectl logs -n kube-system -c export-stdout`.
- Confirm Elasticsearch credentials and host configuration are correct in your ConfigMap.
- Test network connectivity from within the Kubernetes cluster to your Elasticsearch endpoint.
- Tetragon pods not starting or in CrashLoopBackOff state:
- Check pod events for security context or resource issues using `kubectl describe pod -n kube-system `.
- Verify the node kernel version supports eBPF. Use `uname -r` to check (kernel 4.9+ is recommended, while 5.3+ is required for full feature support).
- Volume mount mismatch:
- Ensure the `exportDirectory` in the Tetragon configuration matches the `mountPath` configured in both the Tetragon container and the Filebeat sidecar container.
- If these paths don't align, Filebeat will attempt to read from an empty or non-existent directory.
- Missing or incorrect Kubernetes metadata:
- Verify that Tetragon has the proper RBAC permissions to access the Kubernetes API.
- Check if Tetragon is configured with the correct cluster name by verifying the `--cluster-name` flag in your Helm values.
- RBAC and permissions issues:
- If the Filebeat sidecar fails to start, verify the `securityContext` is set to `runAsUser: 0`. Filebeat often requires root permissions to read logs from host-mounted or shared volumes in Kubernetes.
- Only some events are being collected:
- Check the `tetragon.exportAllowList` values in your deployment to ensure the desired event types (such as `PROCESS_EXEC`, `PROCESS_EXIT`, or `PROCESS_KPROBE`) are included.
### Vendor resources
For further assistance with Cilium Tetragon, refer to the following resources:
- [Tetragon Troubleshooting Guide](https://tetragon.io/docs/troubleshooting/)
## Performance and scaling
For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation.
To ensure optimal performance in high-volume Kubernetes environments, consider the following configuration strategies:
- Transport and collection strategy: This integration uses the `filestream` input via a Filebeat sidecar. By reading logs directly from a shared volume within the pod, you'll ensure low-latency access and avoid the network overhead of external syslog collection. This sidecar approach allows log collection to scale linearly as you add more Cilium Tetragon pods to your cluster.
- Data volume management: You can manage high volumes of security data by configuring the `tetragon.exportAllowList` and `tetragon.exportDenyList` settings. Filtering events at the source (the Tetragon engine) helps you avoid ingesting unnecessary system events, which reduces disk I/O and minimizes the processing load on your Elasticsearch cluster.
## Reference
### Inputs used
The following inputs are supported by this integration:
### Vendor documentation links
You can find more information about Cilium Tetragon in the following resources:
- [Official Tetragon Documentation](https://tetragon.io/docs/)
- [Tetragon Concepts: Events & JSON Export](https://tetragon.io/docs/concepts/events/)
### Data streams
The Cilium Tetragon integration includes the following data stream:
#### log
The `log` data stream captures security and observability events from Tetragon, such as process executions, file operations, and network activity.
##### log fields
This is a list of the fields exported by this data stream:
| Field | Description | Type |
|----------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|------------------|
| @timestamp | Event timestamp. | date |
| cilium_tetragon.log.cluster_name | | keyword |
| cilium_tetragon.log.node_name | | keyword |
| cilium_tetragon.log.process_exec.parent.auid | | long |
| cilium_tetragon.log.process_exec.parent.docker | | keyword |
| cilium_tetragon.log.process_exec.parent.exec_id | | keyword |
| cilium_tetragon.log.process_exec.parent.flags | | keyword |
| cilium_tetragon.log.process_exec.parent.parent_exec_id | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.container.id | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.container.image.id | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.container.image.name | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.container.name | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.container.pid | | long |
| cilium_tetragon.log.process_exec.parent.pod.container.start_time | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.name | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.namespace | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.pod_labels.app.kubernetes.io/name | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.pod_labels.class | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.pod_labels.org | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.pod_labels.pod-template-hash | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.workload | | keyword |
| cilium_tetragon.log.process_exec.parent.pod.workload_kind | | keyword |
| cilium_tetragon.log.process_exec.parent.refcnt | | long |
| cilium_tetragon.log.process_exec.parent.start_time | | keyword |
| cilium_tetragon.log.process_exec.parent.tid | | long |
| cilium_tetragon.log.process_exec.process.auid | | long |
| cilium_tetragon.log.process_exec.process.docker | | keyword |
| cilium_tetragon.log.process_exec.process.exec_id | | keyword |
| cilium_tetragon.log.process_exec.process.flags | | keyword |
| cilium_tetragon.log.process_exec.process.parent_exec_id | | keyword |
| cilium_tetragon.log.process_exec.process.pod.container.image.id | | keyword |
| cilium_tetragon.log.process_exec.process.pod.container.pid | | long |
| cilium_tetragon.log.process_exec.process.pod.container.start_time | | keyword |
| cilium_tetragon.log.process_exec.process.pod.name | | keyword |
| cilium_tetragon.log.process_exec.process.pod.namespace | | keyword |
| cilium_tetragon.log.process_exec.process.pod.pod_labels.app | | keyword |
| cilium_tetragon.log.process_exec.process.pod.pod_labels.app.kubernetes.io/name | | keyword |
| cilium_tetragon.log.process_exec.process.pod.pod_labels.class | | keyword |
| cilium_tetragon.log.process_exec.process.pod.pod_labels.org | | keyword |
| cilium_tetragon.log.process_exec.process.pod.pod_labels.pod-template-hash | | keyword |
| cilium_tetragon.log.process_exec.process.pod.workload | | keyword |
| cilium_tetragon.log.process_exec.process.pod.workload_kind | | keyword |
| cilium_tetragon.log.process_exec.process.start_time | | keyword |
| cilium_tetragon.log.process_exec.process.uid | | long |
| cilium_tetragon.log.process_exit.parent.auid | | long |
| cilium_tetragon.log.process_exit.parent.docker | | keyword |
| cilium_tetragon.log.process_exit.parent.exec_id | | keyword |
| cilium_tetragon.log.process_exit.parent.flags | | keyword |
| cilium_tetragon.log.process_exit.parent.parent_exec_id | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.container.id | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.container.image.id | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.container.image.name | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.container.name | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.container.pid | | long |
| cilium_tetragon.log.process_exit.parent.pod.container.start_time | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.name | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.namespace | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.pod_labels.app.kubernetes.io/name | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.pod_labels.class | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.pod_labels.org | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.pod_labels.pod-template-hash | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.workload | | keyword |
| cilium_tetragon.log.process_exit.parent.pod.workload_kind | | keyword |
| cilium_tetragon.log.process_exit.parent.refcnt | | long |
| cilium_tetragon.log.process_exit.parent.start_time | | keyword |
| cilium_tetragon.log.process_exit.parent.tid | | long |
| cilium_tetragon.log.process_exit.process.auid | | long |
| cilium_tetragon.log.process_exit.process.docker | | keyword |
| cilium_tetragon.log.process_exit.process.exec_id | | keyword |
| cilium_tetragon.log.process_exit.process.flags | | keyword |
| cilium_tetragon.log.process_exit.process.parent_exec_id | | keyword |
| cilium_tetragon.log.process_exit.process.pod.container.image.id | | keyword |
| cilium_tetragon.log.process_exit.process.pod.container.pid | | long |
| cilium_tetragon.log.process_exit.process.pod.container.start_time | | keyword |
| cilium_tetragon.log.process_exit.process.pod.name | | keyword |
| cilium_tetragon.log.process_exit.process.pod.namespace | | keyword |
| cilium_tetragon.log.process_exit.process.pod.pod_labels.app.kubernetes.io/name | | keyword |
| cilium_tetragon.log.process_exit.process.pod.pod_labels.class | | keyword |
| cilium_tetragon.log.process_exit.process.pod.pod_labels.org | | keyword |
| cilium_tetragon.log.process_exit.process.pod.pod_labels.pod-template-hash | | keyword |
| cilium_tetragon.log.process_exit.process.pod.workload | | keyword |
| cilium_tetragon.log.process_exit.process.pod.workload_kind | | keyword |
| cilium_tetragon.log.process_exit.process.refcnt | | long |
| cilium_tetragon.log.process_exit.process.start_time | | keyword |
| cilium_tetragon.log.process_exit.process.uid | | long |
| cilium_tetragon.log.process_exit.signal | | keyword |
| cilium_tetragon.log.process_exit.status | | float |
| cilium_tetragon.log.process_exit.time | | keyword |
| cilium_tetragon.log.process_kprobe.action | | keyword |
| cilium_tetragon.log.process_kprobe.args.capability_arg.name | | keyword |
| cilium_tetragon.log.process_kprobe.args.capability_arg.value | | long |
| cilium_tetragon.log.process_kprobe.args.file_arg.path | | keyword |
| cilium_tetragon.log.process_kprobe.args.file_arg.permission | | keyword |
| cilium_tetragon.log.process_kprobe.args.int_arg | | long |
| cilium_tetragon.log.process_kprobe.args.user_ns_arg.gid | | long |
| cilium_tetragon.log.process_kprobe.args.user_ns_arg.level | | long |
| cilium_tetragon.log.process_kprobe.args.user_ns_arg.ns.inum | | long |
| cilium_tetragon.log.process_kprobe.args.user_ns_arg.ns.is_host | | boolean |
| cilium_tetragon.log.process_kprobe.args.user_ns_arg.uid | | long |
| cilium_tetragon.log.process_kprobe.function_name | | keyword |
| cilium_tetragon.log.process_kprobe.parent.auid | | long |
| cilium_tetragon.log.process_kprobe.parent.docker | | keyword |
| cilium_tetragon.log.process_kprobe.parent.flags | | keyword |
| cilium_tetragon.log.process_kprobe.parent.parent_exec_id | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.container.id | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.container.image.id | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.container.image.name | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.container.name | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.container.pid | | long |
| cilium_tetragon.log.process_kprobe.parent.pod.container.start_time | | date |
| cilium_tetragon.log.process_kprobe.parent.pod.name | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.namespace | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.pod_labels.app.kubernetes.io/name | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.pod_labels.class | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.pod_labels.org | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.workload | | keyword |
| cilium_tetragon.log.process_kprobe.parent.pod.workload_kind | | keyword |
| cilium_tetragon.log.process_kprobe.parent.refcnt | | long |
| cilium_tetragon.log.process_kprobe.policy_name | | keyword |
| cilium_tetragon.log.process_kprobe.process.auid | | long |
| cilium_tetragon.log.process_kprobe.process.docker | | keyword |
| cilium_tetragon.log.process_kprobe.process.flags | | keyword |
| cilium_tetragon.log.process_kprobe.process.ns.cgroup.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.ipc.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.mnt.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.net.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.pid.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.pid.pid_for_children.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.pid_for_children.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.time.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.time.is_host | | boolean |
| cilium_tetragon.log.process_kprobe.process.ns.time.time_for_children.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.time.time_for_children.is_host | | boolean |
| cilium_tetragon.log.process_kprobe.process.ns.time_for_children.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.time_for_children.is_host | | boolean |
| cilium_tetragon.log.process_kprobe.process.ns.user.inum | | long |
| cilium_tetragon.log.process_kprobe.process.ns.user.is_host | | boolean |
| cilium_tetragon.log.process_kprobe.process.ns.uts.inum | | long |
| cilium_tetragon.log.process_kprobe.process.parent_exec_id | | keyword |
| cilium_tetragon.log.process_kprobe.process.pod.container.image.id | | keyword |
| cilium_tetragon.log.process_kprobe.process.pod.container.pid | | long |
| cilium_tetragon.log.process_kprobe.process.pod.container.start_time | | date |
| cilium_tetragon.log.process_kprobe.process.pod.pod_labels.app.kubernetes.io/name | | keyword |
| cilium_tetragon.log.process_kprobe.process.pod.pod_labels.class | | keyword |
| cilium_tetragon.log.process_kprobe.process.pod.pod_labels.org | | keyword |
| cilium_tetragon.log.process_kprobe.process.pod.workload | | keyword |
| cilium_tetragon.log.process_kprobe.process.refcnt | | long |
| cilium_tetragon.log.process_kprobe.return.int_arg | | long |
| cilium_tetragon.log.process_kprobe.return_action | | keyword |
| cilium_tetragon.log.time | | keyword |
| cloud.image.id | Image ID for the cloud instance. | keyword |
| container.labels | Image labels. | object |
| data_stream.dataset | Data stream dataset name. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| event.dataset | Event dataset | constant_keyword |
| event.module | Event module | constant_keyword |
| host.containerized | If the host is a container. | boolean |
| host.os.build | OS build information. | keyword |
| host.os.codename | OS codename, if any. | keyword |
| input.type | Type of Filebeat input. | keyword |
| log.file.device_id | ID of the device containing the filesystem where the file resides. | keyword |
| log.file.fingerprint | The sha256 fingerprint identity of the file when fingerprinting is enabled. | keyword |
| log.file.idxhi | The high-order part of a unique identifier that is associated with a file. (Windows-only) | keyword |
| log.file.idxlo | The low-order part of a unique identifier that is associated with a file. (Windows-only) | keyword |
| log.file.inode | Inode number of the log file. | keyword |
| log.file.vol | The serial number of the volume that contains a file. (Windows-only) | keyword |
| log.flags | Flags for the log file. | keyword |
| log.offset | Offset of the entry in the log file. | long |
## Changelog
| Version | Details | Minimum Kibana version |
|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------|------------------------|
| **0.4.1** | **Bug fix** ([View pull request](https://github.com/elastic/integrations/pull/18969))Remove top level note from docs | 9.0.08.13.0 |
| **0.4.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/15960))Update documentation | 9.0.08.13.0 |
| **0.3.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/15806))Preserve event.original on pipeline error. | 9.0.08.13.0 |
| **0.2.2** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/15719))Generate processor tags and normalize error handler. | 9.0.08.13.0 |
| **0.2.1** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/14753))Changed owners. | 9.0.08.13.0 |
| **0.2.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/13042))Support stack version 9.0. | 9.0.08.13.0 |
| **0.1.0** | **Enhancement** ([View pull request](https://github.com/elastic/integrations/pull/11610))Initial Version | 8.13.0 |