Skip to content

Elasticsearch should write to "path" defined in alias-field instead of returning error "Cannot write to a field alias" #90345

@BBQigniter

Description

@BBQigniter

Description

It would be nice if Elasticsearch would write to the path defined in an alias-field automatically instead of throwing an error and not indexing an event at all. For example in the original Filebeat-mappings (v8.4.1) you find:

    "agent": {
      "properties": {
        "hostname": {
          "path": "agent.name",
          "type": "alias"
        },
        ...
        "name": {
          "ignore_above": 1024,
          "type": "keyword"
        },

As we have Logstash between a Filebeat-sending host and Elasticsearch, Logstash complains with "Cannot write to a field alias [agent.hostname]." I know that there are Filebeat's ingest-pipelines and I want someday to switch to them - but this will take quite some time and probably would create more load on our Elasticsearch-nodes.

Sorry, if this is some duplicate - I could not find any similar github-issue with this feature-request.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions