Rename log.message to log.original #106
Conversation
log.message was confused with message. To bring it in line with elastic#102 the field log.message was renamed to log.original.
ruflin
force-pushed
the
log.message-to-log.original
branch
from
c306a6d to
5547ed7
Compare
|
Love this wording instead of |
schemas/log.yml
Outdated
| type: keyword | ||
| phase: 1 | ||
| example: "Sep 19 08:26:10 localhost My log" | ||
| index: false | ||
| # TODO: Best would be to disable ignore_above completely | ||
| ignore_above: 32766 |
There was a problem hiding this comment.
I'm hesitant about the value of ignore_above, however. ignore_above does not truncate the value itself, it's a safety valve to avoid indexing values that are unexpectedly long in this field.
In other words, I don't think we would be likely to do exact match search or aggregations on an original log message that's this long. Log messages that are really short would be much more likely to be used this way, and as such I think 1024 would be enough.
There was a problem hiding this comment.
Agree with that. Removed the ignore_above.
| @@ -21,15 +21,16 @@ | |||
| description: > | |||
| Offset of the beginning of the log event. | |||
| example: 12 | |||
| - name: message | |||
| - name: original | |||
| type: keyword | |||
| phase: 1 | |||
| example: "Sep 19 08:26:10 localhost My log" | |||
| index: false | |||
There was a problem hiding this comment.
@webmat As we have index: false ignore_above should not play a role anyways?
There was a problem hiding this comment.
LGTM
Not familiar with index:false, but I assume you're right, it would not have mattered. But actually, are you sure we want this to be index:false? I guess so: aggregating on short log messages is kind of an edge case...
Do we go with the new PR merging policies of Beats for this? Or do you want me to merge it?
|
I don't expect this field to be used for aggregation at all. I would prefer to keep here the merging as we had, so please merge :-) |
log.message was confused with message. To bring it in line with #102 the field log.message was renamed to log.original.