-
Notifications
You must be signed in to change notification settings - Fork 528
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Logs intake fixes #9667
Logs intake fixes #9667
Conversation
The intake accepts the ECS field, "event.dataset", and copies it to the field of the same name in resulting documents.
Check the processor.* value, don't just take the presence of error.* fields to mean the event is an error.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @axw!
📚 Go benchmark reportDiff with the
report generated with https://pkg.go.dev/golang.org/x/perf/cmd/benchstat |
* modeldecoder: accept "event.dataset" The intake accepts the ECS field, "event.dataset", and copies it to the field of the same name in resulting documents. * Only set error.grouping_key for error events Check the processor.* value, don't just take the presence of error.* fields to mean the event is an error. * Add logs intake fields to app_logs data stream (cherry picked from commit a27b902)
* modeldecoder: accept "event.dataset" The intake accepts the ECS field, "event.dataset", and copies it to the field of the same name in resulting documents. * Only set error.grouping_key for error events Check the processor.* value, don't just take the presence of error.* fields to mean the event is an error. * Add logs intake fields to app_logs data stream (cherry picked from commit a27b902) Co-authored-by: Andrew Wilkins <[email protected]>
Tested with BC5 on ESS - the fields added by this PR are not yet part of the index template. This might be related to the bug that the apmpackage has not been updated in the last days. The |
Package apm - 8.6.0-preview-1670294014 containing this change is available at https://epr.elastic.co/search?package=apm |
Created a deployment and sent the json payload in the linked PR, created a data view for the |
Motivation/summary
Fix some a few small bugs in the logs intake:
event.dataset
, notdataset
error.grouping_key
for application logs just because they haveerror.*
fieldsChecklist
- [ ] Update CHANGELOG.asciidocapmpackage
have been made)- [ ] Documentation has been updatedHow to test these changes
error.grouping_key
setRelated issues
Closes #9666