Implement ECS-Compatibility Mode

[yaauie]

As a part of the effort to make plugins able to run in an ECS-Compatible manner by default in an upcoming release of Logstash, this plugin needs to either implement an ECS-Compatibility mode or certify that it does not implicitly use fields that conflict with ECS.

Absent destination directive, this plugin populates the translation field, which is undefined in ECS and therefore has the possibility of conflicting with future versions of ECS. The plugin may benefit from an ECS-Compatibility mode that requires the target to be set explicitly?

[kares]

Not sure there's much we could do here, we could default to destination => '' in ECS mode (rewriting the original field) ?

[yaauie]

I see a couple options here:

• require destination to be set when running in ECS-Compatibility mode
• default to in-place translation when in ECS-Compatibility mode (feels like more than an ECS change, but I could be convinced)

Either way, I see implementation being about the same: we can remove the default parameter from the config directive and instead implement default behavior in #register where we have knowledge of @ecs_compatibility.

While we are in here, it may be helpful to align on target like many other plugins.

[kares]

and target would be a name-space 'prefixed' to destination => ... or a destination alias?

[yaauie]

Effectively an alias. most other plugins that allow or require a user to specify a target do so with target and this one is a bit of a loner by using destination.

[kares]

delivered at https://github.com/logstash-plugins/logstash-filter-translate/pull/89