You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The app_logs datastream is used for mapping OTEL logs and (after PR #9068) intake v2 logs. The datastream is currently configured with dynamic: false which disables automatic detection and mapping of new fields.
We want to explore setting dynamic: runtime on the field to enable fields to be searchable by default. One of the motivation for this is to enable greater flexibility for the logs intake support via APM-Server as ECS logging library may add arbitrary key/value pairs to the document root.
While we'd like to move forward with allowing storing arbitrary key/value pairs added via structured logging or MDC, there are some risks associated with that which can lead to data loss. Therefore, this issue is blocked by the following prerequisites:
Probably not blocking but good to have as well: Failed document handler elasticsearch#95534 to avoid losing data if there are conflicts that weren't gracefully handled by the mechanisms listed above and to make it easier to analyze the failures.
The
app_logs
datastream is used for mapping OTEL logs and (after PR #9068) intake v2 logs. The datastream is currently configured withdynamic: false
which disables automatic detection and mapping of new fields.We want to explore setting
dynamic: runtime
on the field to enable fields to be searchable by default. One of the motivation for this is to enable greater flexibility for the logs intake support via APM-Server as ECS logging library may add arbitrary key/value pairs to the document root.Related issues
#8757 (relevant comment)
The text was updated successfully, but these errors were encountered: