-
Notifications
You must be signed in to change notification settings - Fork 418
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
- Loading branch information
Showing
8 changed files
with
270 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
25 changes: 25 additions & 0 deletions
25
experimental/generated/elasticsearch/component/data_stream.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
{ | ||
"_meta": { | ||
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-data_stream.html", | ||
"ecs_version": "1.9.0-dev+exp" | ||
}, | ||
"template": { | ||
"mappings": { | ||
"properties": { | ||
"data_stream": { | ||
"properties": { | ||
"dataset": { | ||
"type": "constant_keyword" | ||
}, | ||
"namespace": { | ||
"type": "constant_keyword" | ||
}, | ||
"type": { | ||
"type": "constant_keyword" | ||
} | ||
} | ||
} | ||
} | ||
} | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
--- | ||
- name: data_stream | ||
title: Data Stream | ||
short: The data_stream fields take part in defining the new data stream naming scheme. | ||
description: > | ||
The data_stream fields take part in defining the new data stream naming scheme. | ||
In the new data stream naming scheme the value of the data stream fields combine to the name of the actual data | ||
stream in the following manner `{data_stream.type}-{data_stream.dataset}-{data_stream.namespace}`. This means the fields | ||
can only contain characters that are valid as part of names of data streams. More details about this can be found in | ||
this https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme[blog post]. | ||
An Elasticsearch data stream consists of one or more backing indices, and a data stream name forms part of the backing indices names. | ||
Due to this convention, data streams must also follow index naming restrictions. For example, data stream names cannot include \, /, *, ?, ", <, >, |, ` `. | ||
Please see the Elasticsearch reference for additional https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#indices-create-api-path-params[restrictions]. | ||
fields: | ||
|
||
- name: type | ||
level: extended | ||
type: constant_keyword | ||
example: logs | ||
# Any future values for `data_stream.type` should also adhere to the following restrictions (these are derived from the Elasticsearch index restrictions): | ||
# * Must not contain `-` | ||
# * Must not start with `+` or `_` | ||
description: > | ||
An overarching type for the data stream. | ||
Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | ||
short: An overarching type for the data stream. | ||
|
||
- name: dataset | ||
level: extended | ||
type: constant_keyword | ||
example: nginx.access | ||
description: > | ||
The field can contain anything that makes sense to signify the source of the data. | ||
Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that | ||
do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the | ||
same value as `data_stream.dataset`. | ||
Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: | ||
* Must not contain `-` | ||
* No longer than 100 characters | ||
short: The field can contain anything that makes sense to signify the source of the data. | ||
|
||
- name: namespace | ||
level: extended | ||
type: constant_keyword | ||
example: production | ||
description: > | ||
A user defined namespace. Namespaces are useful to allow grouping of data. | ||
Many users already organize their indices this way, and the data stream naming scheme now provides this | ||
best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. | ||
Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: | ||
* Must not contain `-` | ||
* No longer than 100 characters | ||
short: A user defined namespace. Namespaces are useful to allow grouping of data. |