apmpackage: Add back "message" to error_logs ds (#6450) (#6453)

Adds back the ecs base "message" field to as an external `ecs` field to the `error_logs` data stream. It causes the errors captured by APM to not have a `message` field which in turn causes the Logs tab to not display the error message. This bug was introduced by #6359. Signed-off-by: Marc Lopez Rubio <[email protected]> (cherry picked from commit 381e594)
elastic · Oct 28, 2021 · 998d476 · 998d476
1 parent 72bcf38
commit 998d476
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/apmpackage/apm/data_stream/error_logs/fields/ecs.yml b/apmpackage/apm/data_stream/error_logs/fields/ecs.yml
@@ -82,6 +82,8 @@
   description: |
     A flat mapping of user-defined labels with string, boolean or number values.
   dynamic: true
+- external: ecs
+  name: message
 - external: ecs
   name: observer.hostname
 - external: ecs

diff --git a/apmpackage/apm/docs/README.md b/apmpackage/apm/docs/README.md
@@ -511,6 +511,7 @@ Application errors are written to `logs-apm.error.*` data stream.
 | kubernetes.pod.name | Kubernetes pod name | keyword |
 | kubernetes.pod.uid | Kubernetes Pod UID | keyword |
 | labels | A flat mapping of user-defined labels with string, boolean or number values. | object |
+| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text |
 | network.carrier.icc | ISO country code, eg. US | keyword |
 | network.carrier.mcc | Mobile country code | keyword |
 | network.carrier.mnc | Mobile network code | keyword |