Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Teach elasticsearch/slowlog fileset to parse more fields #11939

Merged

Conversation

ycombinator
Copy link
Contributor

@ycombinator ycombinator commented Apr 25, 2019

This PR teaches the elasticsearch/slowlog fileset to parse additional fields. These additional fields are introduced in elastic/elasticsearch#41354.

@ycombinator ycombinator added in progress Pull request is currently in progress. module Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. v7.2.0 v8.0.0 labels Apr 25, 2019
@ycombinator ycombinator requested review from a team as code owners April 25, 2019 20:15
@ycombinator ycombinator changed the title Teach Filebeat elasticsearch module to parse more fields Teach elasticsearch/slowlog fileset to parse more fields Apr 25, 2019
@ycombinator ycombinator changed the title Teach elasticsearch/slowlog fileset to parse more fields [WIP] Teach elasticsearch/slowlog fileset to parse more fields Apr 25, 2019
@ycombinator ycombinator force-pushed the fb-es-slowlog-structured-new-fields branch from a24aea9 to 1734efd Compare June 24, 2019 19:19
Copy link
Contributor

@cachedout cachedout left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

EDIT: I didn't see this was a WIP so I re-requested the review of myself.

@cachedout cachedout self-requested a review June 25, 2019 07:56
@ycombinator ycombinator changed the title [WIP] Teach elasticsearch/slowlog fileset to parse more fields Teach elasticsearch/slowlog fileset to parse more fields Jun 25, 2019
@@ -87,6 +87,27 @@
"ignore_missing": true
}
},
{
"rename": {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this going to work if we remove that field in 8? (I have remove that so possibly there this probably will be empty/missing). I forgot about that in my PR, fixing now

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it should be okay because of the ignore_missing flag set on this processor (see a couple lines below). In 9 we can completely remove this processor from the pipeline as, by then we won't expect to see any log lines with doc_type in them.

@ycombinator ycombinator force-pushed the fb-es-slowlog-structured-new-fields branch from db06e97 to cb3b07d Compare July 10, 2019 16:27
@ycombinator ycombinator force-pushed the fb-es-slowlog-structured-new-fields branch from cb3b07d to 483242b Compare July 15, 2019 19:54
@ycombinator ycombinator merged commit cf2ba96 into elastic:master Jul 15, 2019
@ycombinator ycombinator deleted the fb-es-slowlog-structured-new-fields branch July 15, 2019 21:07
@ycombinator ycombinator removed the needs_backport PR is waiting to be backported to other branches. label Jan 15, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Filebeat Filebeat in progress Pull request is currently in progress. module v7.4.0 v8.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants