[8.18](backport #42403) Update Journald fields to better match ECS #42563
+113
−65
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed commit message
The fields produced by the Journald input are updated to better match ECS. Renamed fields:
Dropped fields:
syslog.priority
andsyslog.facility
while keeping their duplicated equivalent:log.syslog.priority
,log.syslog.facility.code
. Renamed fields:syslog.identifier
->log.syslog.appname
,syslog.pid
->log.syslog.procid
.container.id_truncated
is dropped because the full container ID isalready present as
container.id
andcontainer.log.tag
is dropped because it is already present aslog.syslog.appname
. The fieldcontainer.partial
is replaced by the tagpartial_message
if it wastrue
,otherwise no tag is added.
Checklist
I have made corresponding change to the default configuration filesCHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Disruptive User Impact
Because the fields produced by the Journald input are updated to better match ECS, once the user updates Filebeat/Elastic-Agent, the events generated will be slightly different.
Author's Checklist
How to test this PR locally
Run Filebeat with the journald input:
Verify the changes:
Renamed fields:
log.syslog.priority
log.syslog.facility.code
log.syslog.appname
log.syslog.procid
Removed fields:
container.id_truncated
container.log.tag
Instead of
container.partial
, now we set the tagpartial_message
To validate that the tag
partial_message
is correctly added, extractfilebeat/input/journald/testdata/ndjson-parser.journal.gz
and ingest it with the input. There is a single event on this journal file and it containsCONTAINER_PARTIAL_MESSAGE=true
.Related issues
## Use cases## Screenshots## LogsThis is an automatic backport of pull request #42403 done by [Mergify](https://mergify.com).