Skip to content

Adding 'mode' and 'codec' fields to ES monitoring template#143673

Merged
3kt merged 8 commits intoelastic:mainfrom
3kt:mode_codec_monitoring
Mar 6, 2026
Merged

Adding 'mode' and 'codec' fields to ES monitoring template#143673
3kt merged 8 commits intoelastic:mainfrom
3kt:mode_codec_monitoring

Conversation

@3kt
Copy link
Copy Markdown
Contributor

@3kt 3kt commented Mar 5, 2026

Summary

Add mode and codec to the Stack Monitoring (Metricbeat) index template so they can be indexed and queried when present in Metricbeat index metricset events.

What

  • Template: In monitoring-es-mb.json, add two optional keyword fields to the index metricset mapping: elasticsearch.index.mode (e.g. time_series) and elasticsearch.index.codec (e.g. default, best_compression, none).
  • Version: Bump STACK_MONITORING_REGISTRY_VERSION in MonitoringTemplateRegistry so the updated template is applied.

Why

Metricbeat will send these fields from the Elasticsearch index metricset (see elastic/beats#49237). The monitoring template must define the mappings so the data is indexed correctly and can be used in Kibana/dashboards.

This follows the same approach as elastic/elasticsearch#117851, which added tier_preference and creation_date to the monitoring template after they were added in Beats.

Checklist

  • Change is additive only (new optional fields); no breaking or behavioural change for existing data.
  • Template version incremented so new deployments get the updated mapping.

@elasticsearchmachine elasticsearchmachine added v9.4.0 external-contributor Pull request authored by a developer outside the Elasticsearch team labels Mar 5, 2026
Copy link
Copy Markdown
Contributor

@consulthys consulthys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGT Stack Monitoring

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 5, 2026

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)
  • Team:Delivery
  • Team:Search - Inference

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 408837b3-9a71-43d4-8174-c5a0a8f57a4a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Comment @coderabbitai help to get the list of available commands and usage tips.

@3kt 3kt marked this pull request as ready for review March 6, 2026 14:22
@3kt 3kt requested a review from a team as a code owner March 6, 2026 14:22
@3kt 3kt added the auto-backport Automatically create backport pull requests when merged label Mar 6, 2026
@elasticsearchmachine elasticsearchmachine added the Team:Core/Infra Meta label for core/infra team label Mar 6, 2026
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-core-infra (Team:Core/Infra)

@3kt 3kt merged commit 20ca2f4 into elastic:main Mar 6, 2026
35 of 36 checks passed
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

💔 Backport failed

The backport operation could not be completed due to the following error:

There are no branches to backport to. Aborting.

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 143673

szybia added a commit to szybia/elasticsearch that referenced this pull request Mar 6, 2026
…locations

* upstream/main: (153 commits)
  ES|QL: Update docs for TOP_SNIPPETS and DECAY (elastic#143739)
  Correctly include endpoint id in log msg in AuthorizationPoller (elastic#143743)
  Bar searching or sorting on _seq_no when disabled (elastic#143600)
  Generalize `testClientCancellation` test (elastic#143586)
  JSON_EXTRACT: zero-copy byte slicing for object, array, and number extraction (elastic#143702)
  Track recycler pages in circuit breaker (elastic#143738)
  [ESQL] Enable distributed pipeline breakers for external sources via FragmentExec (elastic#143696)
  Adding 'mode' and 'codec' fields to ES monitoring template (elastic#143673)
  [ESQL] Columnar I/O and vectorized block conversion for external sources (elastic#143703)
  Fix flaky MMR diversification YAML tests (elastic#143706)
  ES|QL codegen: check builder arguments for vector support (elastic#143724)
  Add Views Security Model (elastic#141050)
  ESQL: Prevent pushdown of unmapped fields in filters and sorts (elastic#143460)
  Don't run seq_no pruning tests in release CI (elastic#143725)
  ESQL: Support intra-row field references in ROW command (elastic#140217)
  ES|QL: Remove implicit limit in FORK branches in CSV tests (elastic#143601)
  IndexRoutingTests with and without synthetic id (elastic#143566)
  Synthetic id upgrade test in serverless (elastic#142471)
  Disable "Review skipped" comments for PRs without specified labels (elastic#143728)
  Cleanup ES|QL T-Digest code duplication, add memory accounting (elastic#143662)
  ...
sidosera pushed a commit to sidosera/elasticsearch that referenced this pull request Mar 6, 2026
…43673)

* Enhance monitoring template by adding 'mode' and 'codec' fields to monitoring mapping

* Added changelog entry

* Fixed tests

* [CI] Auto commit changes from spotless

---------

Co-authored-by: elasticsearchmachine <infra-root+elasticsearchmachine@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-backport Automatically create backport pull requests when merged backport pending :Core/Infra/Monitoring DEPRECATED, DO NOT USE external-contributor Pull request authored by a developer outside the Elasticsearch team Team:Core/Infra Meta label for core/infra team Team:Stack Monitoring v9.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants