search

logstash-plugins / logstash-mixin-ecs_compatibility_support

Support for the ECS-Compatibility mode targeting Logstash 7.7, for plugins wishing to use this API on older Logstashes
Apache License 2.0
0 stars 7 forks source link

TargetCheck: allow bypass on known-good ECS data #10

Open yaauie opened 2 years ago

yaauie commented 2 years ago

Plugins that use ECSCompatibilitySupport::TargetCheck will log an info-level message when initialized in a non-disabled ECS Compatibility mode and a target is not provided.

Users processing pre-structured known-good ECS data, especially in codec plugins like the JSON and JSON Lines codecs, are seeing floods of this info-level message that are not relevant to them, especially as some codecs are reinitialized for each inbound stream/connection. We need a way to configure the plugin to omit this message.

Currently, the only way is to provide ecs_compatibility => disabled to the codec in question, and finding such a line in a config would not clearly express the intent.

input {
  tcp {
    port => 1234
    codec => json_lines {
      # disable ECS to silence warnings about target not being set.
      ecs_compatibility => disabled
    }
  }
}