logstash-plugins / logstash-filter-translate

Translate filter for Logstash
Apache License 2.0
21 stars 47 forks source link

Feat: ECS compatible default behavior #89

Closed kares closed 3 years ago

kares commented 3 years ago

This PR makes the plugin compliant with ECS by simply using a target => default which makes the plugin act as an in place translator (source = target field).

Some minor tweaks along the way:

closing https://github.com/logstash-plugins/logstash-filter-translate/issues/86

kares commented 3 years ago

Separately, is the deprecation/migration from field to source to align with naming conventions of many other plugins worth pulling into the scope of this PR?

Addressed, let me know how it looks - the only downside we can not rely on config :source, ... :require => true

kares commented 3 years ago

@yaauie given that we made the old field and destination non supported in ECS mode (in favor of source and target) means we actually make user legacy pipeline transitions a bit more demanding - they can not simply just flip a pipeline switch but they will need to update to using the new names. I think it's acceptable but still wanted to double check.

yaauie commented 3 years ago

we actually make user legacy pipeline transitions a bit more demanding - they can not simply just flip a pipeline switch but they will need to update to using the new names. I think it's acceptable but still wanted to double check.

You are absolutely right. I was using it as a forcing function and that is certainly an increase of friction that is not needed.

You should be able to cherry-pick ced4162e0cd296b5444b685c05c1f1556715205f from my fork to bring the field/destination fall-through up into ECS

kcm commented 2 years ago

For what it's worth, in the field we ran into a customer that mistakenly thought the 3.3 and 4.0 versions in the deprecation message were (ancient) Logstash versions. I'm not sure if it's worth clarifying this further, at this point.