Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update SYSLOG5224BASE for ECS 8.2 #324

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

fgierlinger
Copy link

In ECS 8.2.0 multiple syslog fields (such as log.syslog.version and log.syslog.structured_data) have been introduced (elastic/ecs#1793).

The current SYSLOG5424BASE pattern stores some of the syslog fileds in the system field. This field is not defined in the ECS standard.

This PR changes 2 fields of the SYSLOG5242BASE pattern, to use the newly defined fields of the ECS 8.2 definition.

  • system.syslog.version -> log.syslog.version
  • system.syslog.structured_data -> log.syslog.structured_data

The other fields of the SYSLOG5242BASE have been left unchanged, because changing host.hostname to log.syslog.hostname) would introduce a breaking change. I can image many pipelines rely on the host.hostname field.

@fgierlinger fgierlinger closed this by deleting the head repository Oct 2, 2023
@fgierlinger fgierlinger reopened this Oct 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant