overwrite event.ingested field when present

Signed-off-by: inge4pres <[email protected]>
inge4pres · Dec 10, 2024 · 0b6c58b · 0b6c58b
1 parent 6c7cae8
commit 0b6c58b
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 5 deletions.
diff --git a/x-pack/plugin/apm-data/src/main/resources/ingest-pipelines/[email protected] b/x-pack/plugin/apm-data/src/main/resources/ingest-pipelines/[email protected]
@@ -33,4 +33,4 @@ processors:
         ctx.event = [:];
       }
 
-      ctx.event.ingested = metadata().now.withNano(0).format(DateTimeFormatter.ISO_OFFSET_DATE_TIME);
+      ctx.event.ingested = metadata().now.withNano(0).format(DateTimeFormatter.ISO_OFFSET_DATE_TIME);
diff --git a/x-pack/plugin/apm-data/src/yamlRestTest/resources/rest-api-spec/test/20_error_logs.yml b/x-pack/plugin/apm-data/src/yamlRestTest/resources/rest-api-spec/test/20_error_logs.yml
@@ -27,7 +27,9 @@ setup:
   - match: { hits.hits.0.fields: { "log.level": ["error"] } }
   - match: { hits.hits.1.fields: { "log.level": ["warn"] } }
 ---
-"Test traces-apm-* setting event.ingested via ingest pipeline":
+"Test logs-apm.error-* setting event.ingested via ingest pipeline":
+  - requires:
+      test_runner_features: [is_after]
   - do:
       bulk:
         index: logs-apm.error-event-ingested-testing
@@ -37,9 +39,9 @@ setup:
           - create: {}
           - '{"@timestamp": "2017-06-22", "log": {"level": "error"}, "error": {"log": {"message": "loglevel"}, "exception": [{"message": "exception_used"}]}}'
 
-          # event.ingested populated, it gets overwritten
+          # event.ingested populated, it is overwritten with current timestamp
           - create: {}
-          - '{"@timestamp": "2017-06-22", "log": {"level": "warn"}, "error": {"log": {"message": "loglevel"}, "exception": [{"message": "exception_used"}]}, "event": {"ingested": "2017-06-22 22:00:00.000Z"}}'
+          - '{"@timestamp": "2017-06-22", "log": {"level": "warn"}, "error": {"log": {"message": "loglevel"}, "exception": [{"message": "exception_used"}]}, "event": {"ingested": "2017-06-22T12:34:56.789123Z"}}'
 
   - is_false: errors
 
@@ -49,3 +51,4 @@ setup:
         body:
           fields: ["event.ingested"]
   - length: { hits.hits: 2 }
+  - is_after: { hits.hits.1.fields.event\.ingested.0: "2017-06-22T12:34:56.789Z" }
diff --git a/x-pack/plugin/apm-data/src/yamlRestTest/resources/rest-api-spec/test/20_traces_ingest.yml b/x-pack/plugin/apm-data/src/yamlRestTest/resources/rest-api-spec/test/20_traces_ingest.yml
@@ -99,6 +99,8 @@ setup:
   - match: { hits.hits.3.fields: {"event.success_count": [0]} }
 ---
 "Test traces-apm-* setting event.ingested via ingest pipeline":
+  - requires:
+      test_runner_features: [is_after]
   - do:
       bulk:
         index: traces-apm-testing
@@ -108,7 +110,7 @@ setup:
           - create: {}
           - '{"@timestamp": "2017-06-22"}'
 
-          # event.ingested populated, it gets overwritten
+          # event.ingested populated, it is preserved
           - create: {}
           - '{"@timestamp": "2017-06-22", "event": {"ingested": "2017-06-22T00:00:00.123456Z"}}'
 
@@ -120,4 +122,5 @@ setup:
         body:
           fields: ["event.ingested"]
   - length: { hits.hits: 2 }
+  - is_after: { hits.hits.1.fields.event\.ingested.0: "2017-06-22T00:00:00.000Z" }