Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #20522 to 7.x: Fix ECS fields in Elastic Log Driver, change index prefix #20577

Merged
merged 1 commit into from
Aug 17, 2020

Conversation

fearful-symmetry
Copy link
Contributor

@fearful-symmetry fearful-symmetry commented Aug 12, 2020

Cherry-pick of PR #20522 to 7.x branch. Original message:

What does this PR do?

  • Report the correct hostname and properly separated container names in ECS fields
  • Change the prefix to logs-docker so documents show up in the Kibana logs UI

Why is it important?

Although the ECS fields themselves are an issue, we also want Log Driver documents to be easily discoverable in Kibana with little additional configuration. The Logs UI will look for logs-* index patterns by default.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

  • Checkout PR locally
  • Run mage BuildAndInstall
  • Run the plugin using the examples provided in the docs
  • Make sure any host.* and container.* fields are correct, and that logs show up in the Kibana log UI
  • The end result should look something like this:
{
  "_index": ".ds-logs-docker-8.0.0-2020.08.10-000001",
  "_type": "_doc",
  "_id": "_p2a2nMBsYRBGP3GiK5-",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2020-08-10T23:00:26.046Z",
    "container": {
      "labels": {},
      "id": "6abc8bcd301162fe156d0d560362501a9215c8e9e24e582247ad49dfa9ed1872",
      "name": "awesome_heisenberg",
      "image": {
        "name": "redis",
        "tag": "latest"
      }
    },
    "host": {
      "name": "buzzard.nest"
    },
    "ecs": {
      "version": "1.5.0"
    },
    "agent": {
      "type": "elastic-log-driver",
      "version": "8.0.0",
      "ephemeral_id": "617bcc47-3640-4866-8725-6f22546d53ba",
      "id": "a5308b40-344e-41ab-a985-212075a9762a",
      "name": "buzzard.nest"
    },
    "message": "1:M 10 Aug 2020 23:00:26.045 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect."
  },
  "fields": {
    "@timestamp": [
      "2020-08-10T23:00:26.046Z"
    ]
  },
  "sort": [
    1597100426046
  ]
}

)

* change index names, clean up code

* update docs

* fix up metadata handling

* fix docs

* add changelog entry

(cherry picked from commit a8f9cc8)
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Aug 12, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/integrations (Team:Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Aug 12, 2020
@fearful-symmetry fearful-symmetry self-assigned this Aug 12, 2020
@fearful-symmetry fearful-symmetry requested a review from a team August 12, 2020 19:06
@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20577 opened]

  • Start Time: 2020-08-12T19:06:57.559+0000

  • Duration: 28 min 44 sec

Test stats 🧪

Test Results
Failed 0
Passed 3
Skipped 0
Total 3

@fearful-symmetry fearful-symmetry merged commit 40cb94c into elastic:7.x Aug 17, 2020
@zube zube bot removed the [zube]: Done label Nov 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport Team:Integrations Label for the Integrations team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants