-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Register the add_formatted_index as a usable processor. #33800
Register the add_formatted_index as a usable processor. #33800
Conversation
This pull request does not have a backport label.
To fixup this pull request, you need to add the backport labels for the needed
|
Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane) |
You will likely need the changes in #33789 to get CI to pass. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
* Register the add_formatted_index as a usage processor for the processors list. * Re-add removed file. * Add changelog entry. * Add missing return in String(). * Change implementation to use a boolean. (cherry picked from commit 4c4eecf)
) * Register the add_formatted_index as a usage processor for the processors list. * Re-add removed file. * Add changelog entry. * Add missing return in String(). * Change implementation to use a boolean. (cherry picked from commit 4c4eecf) Co-authored-by: Blake Rouse <blake.rouse@elastic.co>
* Register the add_formatted_index as a usage processor for the processors list. * Re-add removed file. * Add changelog entry. * Add missing return in String(). * Change implementation to use a boolean.
What does this PR do?
Registers the
add_formatted_index
processor that was original only an internal processor as a usable processor in the configuration.Why is it important?
This allows the destination index for an event to be changed after other processors have ran. Without it the original
index
field generates theadd_formatted_index
processor internally but is always the first processor to run. This allows the index to be changed after other processors which is needed for architecture V2 change for the Elastic Agent.Checklist
[ ] I have made corresponding change to the default configuration filesCHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.How to test this PR locally
Building
x-pack/filebeat
and using this PR for the Elastic Agent will show how the content of a log file can adjust the resulting index.elastic/elastic-agent#1702
Related issues