-
Notifications
You must be signed in to change notification settings - Fork 101
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add ECS Compatibility mode #291
Conversation
45e67fd
to
2004775
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doc/changelog review: Builds and renders cleanly. Comments inline for your consideration
Since the PR already has a review request for @kares I removed elasticsearch-bot as an assignee |
Co-authored-by: Karen Metts <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 🌈 code is clean. CI red is unrelated flaky test
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Late Review: 👍
there's some opportunity for a minor clean (as outlined in the comment),
also while keeping [@metadata][path]
and [@metadata][host]
makes sense for compatibility and smooth migration I wonder if in case of multiple inputs if it would have been worth also transitioning to a [@metadata][input][file][path]
(and [@metadata][input][file][host]
) to avoid potential collisions.
@@ -41,7 +41,6 @@ def accept(data) | |||
|
|||
def process_event(event) | |||
event.set("[@metadata][path]", path) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
would have been nice to move this final event manipulation part to the file input and simply have:
def process_event(event)
input.post_process_this(event, path) # added path argument
end
... instead of setting meta-data just to retrieve it event.get('[@metadata][path]')
right away in post_process_this
Adds an ECS Compatibility mode.
Without this mode, metadata is persisted to each event's top-level
host
andpath
fields, but with ECS enabled, it is persisted to the ECS-compatible[host][name]
and[log][file][path]
.