The basic payload of data transported by Flume is called an event. An event is composed of zero or more headers and a body.
The headers are key/value pairs that can be used to make routing decisions or carry other structured information (such as the timestamp of the event or hostname of the server where the event originated). You can think of it as serving the same function as HTTP headers—a way to pass additional information that is distinct from the body.
The body is an array of bytes that contains the actual payload. If your input is comprised of tailed logfiles, the array is most likely a UTF-8 encoded
String containing a line of text.
Flume may add additional headers automatically (for example, when a source adds the hostname where ...