search

logstash-plugins / logstash-input-s3

Apache License 2.0
57 stars 150 forks source link

add ecs support #228

Closed kaisecheng closed 3 years ago

kaisecheng commented 3 years ago
This PR adds ECS support and maps the following Legacy ECS
cloudfront_fields [@metadata][s3][cloudfront][fields]
cloudfront_version [@metadata][s3][cloudfront][version]

Closed: https://github.com/logstash-plugins/logstash-input-s3/issues/196

kaisecheng commented 3 years ago

Doc review: Made some suggestions in line for your consideration. Please give me a chance to re-review so that we don't break the doc build.

Do you have an example that would help clarify this info for users?

the cloudfront related fields store in invisible [@metadata] in ECS v1. The data exists but just not visible. I am afraid the example with missing fields causes more confusion. Do you think I should show the example? @karenzone

karenzone commented 3 years ago

Regarding:

the cloudfront related fields store in invisible [@metadata] in ECS v1. The data exists but just not visible. I am afraid the example with missing fields causes more confusion. Do you think I should show the example? @karenzone

@kaisecheng Using examples to illustrate concepts is one of many areas where you excel. If you believe that an example would add more confusion, then I agree that we shouldn't add one.