Change deprecation indexing to use a custom template #64417
Conversation
pugnascotia
added
>enhancement
>non-issue
:Core/Infra/Logging
|
Pinging @elastic/es-core-infra (:Core/Infra/Logging) |
| } | ||
| ], | ||
| "date_detection": false, | ||
| "properties": { |
There was a problem hiding this comment.
we create more fields from our logs. Do we have to define them in the mappings too?
There was a problem hiding this comment.
The dynamic_templates part should take care of those.
|
|
||
| @Override | ||
| protected boolean requiresMasterNode() { | ||
| return true; |
There was a problem hiding this comment.
This should not be overridden to true, since in a rolling environment a 7.11 node could start logging deprecation messages that are indexed prior to the master node being upgraded (meaning that the templates would not be in place), so the messages could end up not being indexed correctly
There was a problem hiding this comment.
In general this change looks good to me, however, I am concerned that this is a breaking change since we're changing the name of the deprecation index, I don't want users who was built tooling on the index name to have that tooling broken when switching minor releases.
Is it possible to keep the original name and make the . prefix change only for 8.0?
| @@ -0,0 +1,17 @@ | |||
| { | |||
| "index_patterns": [".logs-deprecation-elasticsearch"], | |||
There was a problem hiding this comment.
This is a breaking change now, since deprecation logging went into effect in 7.10, and we're changing the index name, are we sure we're okay with the breaking change in a minor release? I'm not sure we should?
There was a problem hiding this comment.
I yanked it from 7.10 so it hasn't been released yet. This will be the first release in 7.11.
There was a problem hiding this comment.
Sounds good, I was going based on the PRs but didn't realize it had been pulled, LGTM then.
The implementation for indexing deprecation logs to a data stream (elastic#58924) relied on the Stack template for `logs-*-*`. This meant that if the user disabled the stack templates, the templates would also be unavailable for the deprecation logs. Change the implementation so that: * There is a separate template for deprecation logging * The data stream is marked as hidden * The data stream name is prefixed with a period (`.`)
Backport of #64417. The implementation for indexing deprecation logs to a data stream (#58924) relied on the Stack template for `logs-*-*`. This meant that if the user disabled the stack templates, the templates would also be unavailable for the deprecation logs. Change the implementation so that: * There is a separate template for deprecation logging * The data stream is marked as hidden * The data stream name is prefixed with a period (`.`)
The implementation for indexing deprecation logs to a data stream (#58924) relied on the Stack template for
logs-*-*. This meant that if the user disabled the stack templates, the templates would also be unavailable for the deprecation logs.Change the implementation so that:
.)