Skip to content

Add data_stream fields to spec #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

Add data_stream fields to spec #38

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5b4444b
Add data_stream fields to spec
felixbarny Dec 7, 2020
06e80e1
Replace index with data stream
felixbarny Dec 7, 2020
9364777
Change default of data_stream.dataset to generic
felixbarny Dec 8, 2020
8b37b7e
Add more disallowed characters, require lower case
felixbarny Mar 17, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 53 additions & 1 deletion spec/spec.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,14 @@
"required": false,
"url": "https://www.elastic.co/guide/en/ecs/current/ecs-event.html",
"default": "${service.name}.log OR ${service.name}.${appender.name}",
"sanitization": {
"value": {
"replacements": ["\\", "/", "*", "?", "\"", "<", ">", "|", " ", ",", "#", ":", "-"],
"substitute": "_",
"max_chars": 100,
"lower_case": true
}
},
"comment": [
"Configurable by users.",
"If the user manually configures the service name,",
Expand All @@ -82,7 +90,51 @@
"they should set `event.dataset=${service.name}.${appender.name}` if the appender name is available in the logging library.",
"Otherwise, agents should also set `event.dataset=${service.name}.log`",
"",
"The field helps to filter for different log streams from the same pod, for example and is required for log anomaly detection."
"The field helps to filter for different log streams from the same pod, for example and is required for log anomaly detection.",
"",
"Must be in sync with `data_stream.dataset`."
]
},
"data_stream.dataset": {
"type": "string",
"required": false,
"url": "https://github.com/elastic/ecs/blob/master/rfcs/text/0009-data_stream-fields.md",
"default": "${service.name}.log OR ${service.name}.${appender.name}",
"sanitization": {
"value": {
"replacements": ["\\", "/", "*", "?", "\"", "<", ">", "|", " ", ",", "#", ":", "-"],
"substitute": "_",
"max_chars": 100,
"lower_case": true
}
},
"comment": [
"Configurable by users.",
"Influences which data stream the logs will be stored in (`logs-{data_stream.dataset}-{data_stream.namespace}`)",
"If unspecified, Filebeat will set the value to `generic`.",
"",
"Must be in sync with `event.dataset`."
]
},
"data_stream.namespace": {
"type": "string",
"required": false,
"url": "https://github.com/elastic/ecs/pull/1145",
"default": null,
"sanitization": {
"value": {
"replacements": ["\\", "/", "*", "?", "\"", "<", ">", "|", " ", ",", "#", ":"],
"substitute": "_",
"max_chars": 100,
"lower_case": true
}
},
"comment": [
"Configurable by users.",
"Influences which data stream the logs will be stored in (`logs-{data_stream.dataset}-{data_stream.namespace}`)",
"If unspecified, Filebeat will set the value to `default`.",
"",
"Must be in sync with `data_stream.dataset`."
]
},
"process.thread.name": {
Expand Down