add ecs support #179
add ecs support #179
Conversation
Co-authored-by: Ry Biesemeyer <ry.biesemeyer@elastic.co>
There was a problem hiding this comment.
First: 🌮🌮🌮 (I meant 🎉 but 🌮 are also good 😂 ). Thank you much for carrying this forward.
I've left a couple notes in-line.
I also have thoughts on user experience that I completely failed to define in the original requirements 🤦🏼 :
I believe we should auto-target when the source specifies an ip sub-field, and should otherwise require a target in ECS mode instead of guessing client.
For example, when the user specifies source => "[host][ip]" and doesn't provide a target we can safely assume target => "[host]", but if they specify a non-ECS source => "host_ip" we can't reasonably assume enough in the context of ECS to properly categorize it.
Pseudo-code:
def default_ecs_target
return @source[0...-4] if @source.end_with?('[ip]')
fail(LogStash::ConfigurationError, "GeoIP Filter in ECS-Compatiblity mode requires a `target` when `source` is not an `ip` sub-field")
end
lib/logstash/filters/geoip.rb
Outdated
| def setup_target_field | ||
| @target ||= ecs_select[disabled:'geoip', v1:'client'] | ||
|
|
||
| if ecs_compatibility != :disabled and !ECS_TARGET_FIELD.include?(@target) |
There was a problem hiding this comment.
🤔 this will warn when a user explicitly specifies a field in the canonical field reference syntax ([source]) but not in the top-level-field shorthand syntax (source).
We may need to normalize the input before validating.
auto set `target` from `source` normalize `target`
docs/index.asciidoc
Outdated
| @@ -89,6 +89,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ | |||
| [cols="<,<,<",options="header",] | |||
| |======================================================================= | |||
| |Setting |Input type|Required | |||
| | <<plugins-{type}s-{plugin}-ecs_compatibility>> | <<string,string>>|No | |||
There was a problem hiding this comment.
Doc: Please order alphabetically in both the table and doc description. Otherwise, build cleanly and LGTM>
|
published at v7.1.0 |
Elastic Common Schema Support
targetusesclientas the default in ECS; legacy keepsgeoipas defaultCo-authored-by: Ry Biesemeyer ry.biesemeyer@elastic.co
Fix: #163