search

majikthys / log4j2-logstash-jsonevent-layout

Log4J2 Layout as a Logstash "json_event"
Other
40 stars 34 forks source link

Properties field should be a JSON hash, and not array of hashes. #13

Closed rarruda closed 10 years ago

rarruda commented 10 years ago

This allows ElasticSearch to treat Properties as an Object, instead of Array when indexing. Making easier to search/analyze, and optimize our schema according to pre-defined Property values.

As it is now for the Properties element: "Properties":[ {"some_key":"some_value"},{"key_2":"value_2"} ] But should be: "Properties":{"some_key":"some_value","key_2":"value_2"}

ES Objects maps much better to this use case (logging) where Properties tend to be unique... http://www.elasticsearch.org/guide/en/elasticsearch/reference/master/mapping-object-type.html http://www.elasticsearch.org/guide/en/elasticsearch/reference/master/mapping-array-type.html

majikthys commented 10 years ago

This is a pretty serious bug! Thank you. Sorry for the late response. Merged.