"all program" would be more useful than "all system"?

[jacinchan]

hi, i wonder if there is a config to change the filter for "all system", so this button can filter by "program" instead of "host". i think this is more useful, if you have many hosts and few programs.

[devon-whil]

I just swapped the two. My mapping looks like:

"mapping": {
    "timestamp": "@timestamp",
    "display_timestamp": "@timestamp",
    "hostname": "kubernetes.container_name",
    "program": "kubernetes.host",
    "message": "log"
}

[sivasamyk]

You could map any field to hostname. I mapped hostname because I started developing logtrail with syslog so listing hostname made sense.