Open ppcad opened 3 weeks ago
As we use opensearch datastreams to ensure the indizis are rotated if they grow upon a specific level we use the default_Index option in another way. For us it is the name of the datastream to write the logs to like the name of a kafka topic. We dont have to set the index during processing.
Logs that are written into the default index using the OpenSearch Output do not contain their original target index, since the original index field must be overwritten to write the logs into the default index. It would be useful for debugging if the original index was written into an additional field (e.g.
original_index
) analogous to the fieldreason
.