Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Preserve JSON types in flatten_json function #13947

Merged
merged 9 commits into from
Nov 15, 2022
Merged

Preserve JSON types in flatten_json function #13947

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
866b52b
preserve JSON types when flattening
patrickmann Nov 11, 2022
08a4e0f
cl
patrickmann Nov 11, 2022
49b972b
add stringify optional param
patrickmann Nov 11, 2022
c9055c8
make stringify parameter optional
patrickmann Nov 11, 2022
6317c1f
update cl
patrickmann Nov 11, 2022
b4dcfc7
incorporate review feedback
patrickmann Nov 14, 2022
efcb9d0
add to upgrading.md
patrickmann Nov 15, 2022
4b5427b
put upgrade message in proper section
patrickmann Nov 15, 2022
b658e67
minor wording change
patrickmann Nov 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
9 changes: 4 additions & 5 deletions UPGRADING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ Please make sure to create a MongoDB database backup before starting the upgrade
* Support for Elasticsearch 6.X has been removed! Please use either Elasticsearch 7.10.2 or, preferably, latest OpenSearch.
* Graylog 5 needs at least MongoDB 5.0. Our recommended upgrade path is to first bring your MongoDB to 5.0 and then perform the Graylog upgrade.
Hint: Graylog 4.3.x does support MongoDB 5.0, which allows for a seamless upgrade path.
* `flatten_json` now preserves the original type of the extracted values, instead
mpfz0r marked this conversation as resolved.
Show resolved Hide resolved
of converting them to string. An optional flag is provided so existing rules can
continue using the legacy behavior.


## Disallowing embedding the frontend by default

Expand Down Expand Up @@ -43,11 +47,6 @@ It is now possible to change this behavior. When configuration property `stream_
If all of your streams go to dedicated, separate index sets, it is advised to keep the default value of `stream_aware_field_types` property (`false`). It will decrease the load on ES/OS and stream separation across index sets already helps with showing proper fields for a query.
On the other hand, if multiple streams go to the same index sets, and you want precise field types and suggestions, you should set it to `true`. Consider monitoring your ES/OS load after that change, especially when using huge numbers of fields and streams.

## Breaking changes to pipeline functions
`flatten_json` now preserves the original type of the extracted values, instead
of converting them to string. An optional flag is provided, so existing rules can
continue using the legacy behavior.

## API Endpoint Deprecations

The following API endpoints are deprecated beginning with 5.0.
Expand Down