Revert decision to unify generic and fallback fields

elastic · Jun 15, 2021 · 1683e13 · 1683e13
1 parent 4daf7a6
commit 1683e13
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 53 deletions.
diff --git a/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.test.ts b/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.test.ts
@@ -154,16 +154,6 @@ describe('Generic Rules', () => {
               "generic.test",
             ],
           },
-          Object {
-            "constant": "][",
-          },
-          Object {
-            "field": "log.level",
-            "highlights": Array [],
-            "value": Array [
-              "TEST_LEVEL",
-            ],
-          },
           Object {
             "constant": "] ",
           },
@@ -252,16 +242,6 @@ describe('Generic Rules', () => {
               "generic.test",
             ],
           },
-          Object {
-            "constant": "][",
-          },
-          Object {
-            "field": "log.level",
-            "highlights": Array [],
-            "value": Array [
-              "TEST_LEVEL",
-            ],
-          },
           Object {
             "constant": "] ",
           },

diff --git a/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.ts b/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic.ts
@@ -7,12 +7,17 @@
 
 import { LogMessageFormattingRule } from '../rule_types';
 
-const BUILTIN_GENERIC_MESSAGE_FIELDS = ['message', '@message', 'log.original', 'event.original'];
+const BUILTIN_GENERIC_MESSAGE_FIELDS = ['message', '@message'];
+const BUILTIN_FALLBACK_MESSAGE_FIELDS = ['log.original', 'event.original'];
 
-export const getGenericRules = (genericMessageFields: string[]) =>
-  Array.from(new Set([...genericMessageFields, ...BUILTIN_GENERIC_MESSAGE_FIELDS])).reduce<
-    LogMessageFormattingRule[]
-  >((genericRules, fieldName) => [...genericRules, ...createGenericRulesForField(fieldName)], []);
+export const getGenericRules = (genericMessageFields: string[]): LogMessageFormattingRule[] => [
+  ...Array.from(new Set([...genericMessageFields, ...BUILTIN_GENERIC_MESSAGE_FIELDS])).flatMap(
+    createGenericRulesForField
+  ),
+  ...BUILTIN_FALLBACK_MESSAGE_FIELDS.filter(
+    (fieldName) => !genericMessageFields.includes(fieldName)
+  ).flatMap(createFallbackRulesForField),
+];
 
 const createGenericRulesForField = (fieldName: string) => [
   {
@@ -73,14 +78,14 @@ const createGenericRulesForField = (fieldName: string) => [
   },
   {
     when: {
-      exists: ['event.dataset', fieldName, 'error.stack_trace.text'],
+      exists: ['log.level', fieldName, 'error.stack_trace.text'],
     },
     format: [
       {
         constant: '[',
       },
       {
-        field: 'event.dataset',
+        field: 'log.level',
       },
       {
         constant: '] ',
@@ -98,14 +103,14 @@ const createGenericRulesForField = (fieldName: string) => [
   },
   {
     when: {
-      exists: ['event.dataset', fieldName],
+      exists: ['log.level', fieldName],
     },
     format: [
       {
         constant: '[',
       },
       {
-        field: 'event.dataset',
+        field: 'log.level',
       },
       {
         constant: '] ',
@@ -117,18 +122,9 @@ const createGenericRulesForField = (fieldName: string) => [
   },
   {
     when: {
-      exists: ['log.level', fieldName, 'error.stack_trace.text'],
+      exists: [fieldName, 'error.stack_trace.text'],
     },
     format: [
-      {
-        constant: '[',
-      },
-      {
-        field: 'log.level',
-      },
-      {
-        constant: '] ',
-      },
       {
         field: fieldName,
       },
@@ -142,36 +138,33 @@ const createGenericRulesForField = (fieldName: string) => [
   },
   {
     when: {
-      exists: ['log.level', fieldName],
+      exists: [fieldName],
     },
     format: [
-      {
-        constant: '[',
-      },
-      {
-        field: 'log.level',
-      },
-      {
-        constant: '] ',
-      },
       {
         field: fieldName,
       },
     ],
   },
+];
+
+const createFallbackRulesForField = (fieldName: string) => [
   {
     when: {
-      exists: [fieldName, 'error.stack_trace.text'],
+      exists: ['event.dataset', fieldName],
     },
     format: [
       {
-        field: fieldName,
+        constant: '[',
       },
       {
-        constant: '\n',
+        field: 'event.dataset',
       },
       {
-        field: 'error.stack_trace.text',
+        constant: '] ',
+      },
+      {
+        field: fieldName,
       },
     ],
   },