Is this by design? Need I create a template with a map to get the main fields aggregatable instead because, my data doesn't have a keyword in the source? Logstash seems to be parsing everything correctly based on the pattern/conf
Wondering if you have any insight for me. If it doesn't work as is plan is to create a template but, I'd like to avoid that if possible because this will be getting data from a lot of different places and if it works using the default that would be great.