You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently metricbeat or filebeat report errors as a message under the error field in the event:
{
"error": "Hello world error"
}
This worked well so far but has its limitations. It's hard to find all errors of one type because messages can change over time and it is tricky to filter by it.
Inspired by the hearbeat error format (see #3406) I suggest for 6.0 we enhance and unify the error format across all beats:
The above allows errors to add more meta data. The code can be used to introduce certain errors codes and the level can be used to define the "severity" of an error so people can filter based on it.
By default, all current error fields will go into error.message in the future.
The above is a breaking change and it must be ensured that 5.x and 6.x beats data will not go into the same index. This should be solved through the beats index versioning.
The text was updated successfully, but these errors were encountered:
Currently error message in metricbeat are written into the `error` field. In heartbeat `error.message` is used. To unify the error structure and allow in the future to support things like `error.code` and others inside the error, `error` is changed to `error.message`.
Currently internally all `error` are just written to `error.message`. In future PR's an internal logic should be added to support `error.code` and others so Metricsets, Prospectors etc. can make use of it.
Changes
* Change `error` to `error.message`
* Move error mappings from heartbeat to libbeat
Closeselastic#3951
Currently error message in metricbeat are written into the `error` field. In heartbeat `error.message` is used. To unify the error structure and allow in the future to support things like `error.code` and others inside the error, `error` is changed to `error.message`.
Currently internally all `error` are just written to `error.message`. In future PR's an internal logic should be added to support `error.code` and others so Metricsets, Prospectors etc. can make use of it.
Changes
* Change `error` to `error.message`
* Move error mappings from heartbeat to libbeat
Closes#3951
Currently metricbeat or filebeat report errors as a message under the
error
field in the event:This worked well so far but has its limitations. It's hard to find all errors of one type because messages can change over time and it is tricky to filter by it.
Inspired by the hearbeat error format (see #3406) I suggest for 6.0 we enhance and unify the error format across all beats:
The above allows errors to add more meta data. The code can be used to introduce certain errors codes and the level can be used to define the "severity" of an error so people can filter based on it.
By default, all current
error
fields will go intoerror.message
in the future.The above is a breaking change and it must be ensured that 5.x and 6.x beats data will not go into the same index. This should be solved through the beats index versioning.
The text was updated successfully, but these errors were encountered: