Deprecation dataset value changed to elasticsearch.deprecation (#83254)

The dataset value for all ES logs are prefixed with elasticsearch + log type. Like elasticsearch.server. Deprecation log had it reverted deprecation.elasticsearch This commit renames the dataset for deprecation logs to `elasticsearch.deprecation. closes #83251
elastic · Jun 14, 2022 · bb06fac · bb06fac
1 parent 590e523
commit bb06fac
Show file tree

Hide file tree

Showing 7 changed files with 42 additions and 36 deletions.
diff --git a/distribution/src/config/log4j2.properties b/distribution/src/config/log4j2.properties
@@ -63,7 +63,7 @@ appender.deprecation_rolling.name = deprecation_rolling
 appender.deprecation_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation.json
 appender.deprecation_rolling.layout.type = ECSJsonLayout
 # Intentionally follows a different pattern to above
-appender.deprecation_rolling.layout.dataset = deprecation.elasticsearch
+appender.deprecation_rolling.layout.dataset = elasticsearch.deprecation
 appender.deprecation_rolling.filter.rate_limit.type = RateLimitingFilter
 
 appender.deprecation_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation-%i.json.gz

diff --git a/docs/changelog/83254.yaml b/docs/changelog/83254.yaml
@@ -0,0 +1,6 @@
+pr: 83254
+summary: Deprecation dataset value changed to `elasticsearch.deprecation`
+area: Infra/Logging
+type: bug
+issues:
+ - 83251
diff --git a/qa/logging-config/src/test/java/org/elasticsearch/common/logging/JsonLoggerTests.java b/qa/logging-config/src/test/java/org/elasticsearch/common/logging/JsonLoggerTests.java
@@ -124,14 +124,14 @@ public void testDeprecatedMessageWithoutXOpaqueId() throws IOException {
                 jsonLogs,
                 contains(
                     allOf(
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "CRITICAL"),
                         hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                         hasEntry("elasticsearch.cluster.name", "elasticsearch"),
                         hasEntry("elasticsearch.node.name", "sample-name"),
                         hasEntry("message", "deprecated message1"),
                         hasEntry("data_stream.type", "logs"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasKey("ecs.version"),
                         hasEntry(DeprecatedMessage.KEY_FIELD_NAME, "a key"),
@@ -167,8 +167,8 @@ public void testCompatibleLog() throws Exception {
                     contains(
                         allOf(
                             hasEntry("log.level", "CRITICAL"),
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
@@ -185,8 +185,8 @@ public void testCompatibleLog() throws Exception {
                         allOf(
                             hasEntry("log.level", "CRITICAL"),
                             // event.dataset and data_stream.dataset have to be the same across the data stream
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
@@ -239,8 +239,8 @@ public void testParseFieldEmittingDeprecatedLogs() throws Exception {
                         // deprecation log for field deprecated_name
                         allOf(
                             hasEntry("log.level", "WARN"),
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
@@ -257,8 +257,8 @@ public void testParseFieldEmittingDeprecatedLogs() throws Exception {
                         // deprecation log for field deprecated_name2 (note it is not being throttled)
                         allOf(
                             hasEntry("log.level", "WARN"),
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
@@ -275,8 +275,8 @@ public void testParseFieldEmittingDeprecatedLogs() throws Exception {
                         // compatible log line
                         allOf(
                             hasEntry("log.level", "CRITICAL"),
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
@@ -326,14 +326,14 @@ public void testDeprecatedMessage() throws Exception {
                     jsonLogs,
                     contains(
                         allOf(
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
                             hasEntry("log.level", "WARN"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                             hasEntry("elasticsearch.cluster.name", "elasticsearch"),
                             hasEntry("elasticsearch.node.name", "sample-name"),
                             hasEntry("message", "deprecated message1"),
                             hasEntry("data_stream.type", "logs"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasKey("ecs.version"),
                             hasEntry(DeprecatedMessage.KEY_FIELD_NAME, "someKey"),
@@ -578,7 +578,7 @@ public void testDuplicateLogMessages() throws Exception {
                     jsonLogs,
                     contains(
                         allOf(
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
                             hasEntry("log.level", "CRITICAL"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                             hasEntry("elasticsearch.cluster.name", "elasticsearch"),
@@ -611,7 +611,7 @@ public void testDuplicateLogMessages() throws Exception {
                     jsonLogs,
                     contains(
                         allOf(
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
                             hasEntry("log.level", "CRITICAL"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                             hasEntry("elasticsearch.cluster.name", "elasticsearch"),
@@ -621,7 +621,7 @@ public void testDuplicateLogMessages() throws Exception {
                             hasEntry("elasticsearch.event.category", "other")
                         ),
                         allOf(
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
                             hasEntry("log.level", "CRITICAL"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                             hasEntry("elasticsearch.cluster.name", "elasticsearch"),

diff --git a/...-config/src/test/resources/org/elasticsearch/common/logging/json_layout/log4j2.properties b/...-config/src/test/resources/org/elasticsearch/common/logging/json_layout/log4j2.properties
@@ -15,14 +15,14 @@ appender.deprecated.name = deprecated
 appender.deprecated.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecated.json
 # Intentionally follows a different pattern to above
 appender.deprecated.layout.type = ECSJsonLayout
-appender.deprecated.layout.dataset = deprecation.elasticsearch
+appender.deprecated.layout.dataset = elasticsearch.deprecation
 appender.deprecated.filter.rate_limit.type = RateLimitingFilter
 
 appender.deprecatedconsole.type = Console
 appender.deprecatedconsole.name = deprecatedconsole
 appender.deprecatedconsole.layout.type = ECSJsonLayout
 # Intentionally follows a different pattern to above
-appender.deprecatedconsole.layout.dataset = deprecation.elasticsearch
+appender.deprecatedconsole.layout.dataset = elasticsearch.deprecation
 appender.deprecatedconsole.filter.rate_limit.type = RateLimitingFilter
 
 

diff --git a/server/src/main/java/org/elasticsearch/common/logging/DeprecatedMessage.java b/server/src/main/java/org/elasticsearch/common/logging/DeprecatedMessage.java
@@ -56,7 +56,7 @@ private static ESLogMessage getEsLogMessage(
         String messagePattern,
         Object[] args
     ) {
-        ESLogMessage esLogMessage = new ESLogMessage(messagePattern, args).field("data_stream.dataset", "deprecation.elasticsearch")
+        ESLogMessage esLogMessage = new ESLogMessage(messagePattern, args).field("data_stream.dataset", "elasticsearch.deprecation")
             .field("data_stream.type", "logs")
             .field("data_stream.namespace", "default")
             .field(KEY_FIELD_NAME, key)

diff --git a/.../qa/rest/src/javaRestTest/java/org/elasticsearch/xpack/deprecation/DeprecationHttpIT.java b/.../qa/rest/src/javaRestTest/java/org/elasticsearch/xpack/deprecation/DeprecationHttpIT.java
@@ -420,12 +420,12 @@ public void testDeprecationMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "settings"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "WARN"),
                         hasKey("log.logger"),
                         hasEntry("message", "[deprecated_settings] usage is deprecated. use [settings] instead")
@@ -438,12 +438,12 @@ public void testDeprecationMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "api"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/deprecated_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "WARN"),
                         hasKey("log.logger"),
                         hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")
@@ -490,12 +490,12 @@ public void testDeprecationCriticalWarnMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "settings"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_critical_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "CRITICAL"),
                         hasKey("log.logger"),
                         hasEntry("message", "[deprecated_settings] usage is deprecated. use [settings] instead")
@@ -542,12 +542,12 @@ public void testDeprecationWarnMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "settings"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_warn_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "WARN"),
                         hasKey("log.logger"),
                         hasEntry("message", "[deprecated_warn_settings] usage is deprecated but won't be breaking in next version")
@@ -560,12 +560,12 @@ public void testDeprecationWarnMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "api"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/deprecated_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "WARN"),
                         hasKey("log.logger"),
                         hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")
@@ -624,12 +624,12 @@ public void testCompatibleMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "compatible_api"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "compatible_key"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "CRITICAL"),
                         hasKey("log.logger"),
                         hasEntry("message", "You are using a compatible API for this request")
@@ -642,12 +642,12 @@ public void testCompatibleMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "compatible_api"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/compat_only"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "CRITICAL"),
                         hasKey("log.logger"),
                         hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")

diff --git a/...c/main/java/org/elasticsearch/xpack/deprecation/logging/DeprecationIndexingComponent.java b/...c/main/java/org/elasticsearch/xpack/deprecation/logging/DeprecationIndexingComponent.java
@@ -75,7 +75,7 @@ private DeprecationIndexingComponent(
         final Configuration configuration = context.getConfiguration();
 
         final EcsLayout ecsLayout = ECSJsonLayout.newBuilder()
-            .setDataset("deprecation.elasticsearch")
+            .setDataset("elasticsearch.deprecation")
             .setConfiguration(configuration)
             .build();