Implement ECS-Compatibility Mode

logstash-plugins / logstash-filter-metrics

Apache License 2.0

15 stars 29 forks source link

Implement ECS-Compatibility Mode #60

Open kares opened 4 years ago

kares commented 4 years ago

As a part of the effort to make plugins able to run in an ECS-Compatible manner by default in an upcoming release of Logstash, this plugin needs to either implement an ECS-Compatibility mode or certify that it does not implicitly use fields that conflict with ECS.

in ECS mode would be nice to event.set("event.kind","event") for categorization?
- maybe also an event.source: 'logstash' would make sense?
otherwise having "[{field}][mean]" and similar - isn’t generalized in ECS

kares commented 4 years ago

^^^ these sound more like ECS "enhancements", please review @yaauie

yaauie commented 4 years ago

I agree that these are "enhancements". We may want to open a conversation about the shape of this snapshot data with the ECS team to see if they have generalizations in mind or recommendations for avoiding future collisions.

Because the metrics and timers need to be explicitly given (and are therefore not implicitly in conflict with ECS), I believe improvements we make here are largely orthogonal to the ECS-by-default effort.

TheVastyDeep commented 1 year ago

If this ever gets done it would be nice to fix issue 14 as part of it (don't send the hostname in the [message] field).