Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance error in beats event #3951

Closed
ruflin opened this issue Apr 7, 2017 · 0 comments
Closed

Enhance error in beats event #3951

ruflin opened this issue Apr 7, 2017 · 0 comments
Labels
discuss Issue needs further discussion. libbeat v6.0.0-alpha1

Comments

@ruflin
Copy link
Contributor

ruflin commented Apr 7, 2017

Currently metricbeat or filebeat report errors as a message under the error field in the event:

{
    "error": "Hello world error"
}

This worked well so far but has its limitations. It's hard to find all errors of one type because messages can change over time and it is tricky to filter by it.

Inspired by the hearbeat error format (see #3406) I suggest for 6.0 we enhance and unify the error format across all beats:

"error": {
	"message": "Hello world",			(text)
	"level": "warning",				(keyword)
	"type": "io",					(keyword
	"code": 404,					(long)
}

The above allows errors to add more meta data. The code can be used to introduce certain errors codes and the level can be used to define the "severity" of an error so people can filter based on it.

By default, all current error fields will go into error.message in the future.

The above is a breaking change and it must be ensured that 5.x and 6.x beats data will not go into the same index. This should be solved through the beats index versioning.

@ruflin ruflin added discuss Issue needs further discussion. libbeat v6.0.0-alpha1 labels Apr 7, 2017
ruflin added a commit to ruflin/beats that referenced this issue Apr 12, 2017
Currently error message in metricbeat are written into the `error` field. In heartbeat `error.message` is used. To unify the error structure and allow in the future to support things like `error.code` and others inside the error, `error` is changed to `error.message`.

Currently internally all `error` are just written to `error.message`. In future PR's an internal logic should be added to support `error.code` and others so  Metricsets, Prospectors etc. can make use of it.

Changes

* Change `error` to `error.message`
* Move error mappings from heartbeat to libbeat

Closes elastic#3951
@tsg tsg closed this as completed in #3987 Apr 12, 2017
tsg pushed a commit that referenced this issue Apr 12, 2017
Currently error message in metricbeat are written into the `error` field. In heartbeat `error.message` is used. To unify the error structure and allow in the future to support things like `error.code` and others inside the error, `error` is changed to `error.message`.

Currently internally all `error` are just written to `error.message`. In future PR's an internal logic should be added to support `error.code` and others so  Metricsets, Prospectors etc. can make use of it.

Changes

* Change `error` to `error.message`
* Move error mappings from heartbeat to libbeat

Closes #3951
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
discuss Issue needs further discussion. libbeat v6.0.0-alpha1
Projects
None yet
Development

No branches or pull requests

1 participant