Remove .log suffix from default event.dataset #63
Conversation
💚 Build Succeeded
Expand to view the summary
Build stats
Trends 🧪 |
There was a problem hiding this comment.
LGTM
I tried to figure out where this .log is coming from. There are some datasets where we used .log. This predates the data stream naming scheme and data_stream.* fields. If I remember correctly we did this to differentiate the logs from the metrics dataset. But with data_stream.type this differentiation is done by an additional field and it is now even in a different index so this is not needed anymore.
|
ECS loggers aim to be compatible with older ES versions so we should also think about legacy indices. However, |
|
This will also need to be fixed here: https://github.com/elastic/apm/blob/7544c0ba7d8ead1cc13ebc477b106cf1be2088e0/specs/agents/log-onboarding.md#eventdataset |
|
From the Logs UI perspective there is no dependency on specific dataset suffixes, so this sounds fine by me. |
See elastic/ecs-logging#63 for the context
See elastic/ecs-logging#63 for the context
Back in #63 the guidance was changed to *not* have the .log suffix on `event.dataset`.
Back in #63 the guidance was changed to *not* have the .log suffix on `event.dataset`.
The
.logsuffix inevent.datasetis considered bad practice, according to @ruflin.Instead of
my_service.log,my_serviceis preferred for theevent.dataset.@weltenwort do you agree with that?
See also the discussion in elastic/beats#27404 (comment)