[Logs+] Change default of ignore_malformed
to true
in logs-*-*
data streams
#95224
Labels
:Data Management/Data streams
Data streams and their lifecycles
>enhancement
:Search/Mapping
Index mappings, including merging and defining field types
Team:Data Management
Meta label for data/management team
Team:Search
Meta label for search team
Description
As part of our effort to accept all logs by default, one of the first issues we want to address is the rejection of log events due to field type not matching the corresponding mapping.
The intention of this issue is to change the default of
ignore_malformed
totrue
specifically forlogs-*-*
data streams.The text was updated successfully, but these errors were encountered: