Our current integrations are inconsistent when it comes to preserving original logs/fields. Some integrations preserve event.original, while others do not. Preserving raw logs has a significant impact on storage, often doubling the size of an event.
While there are cases whereby preservation of raw logs is a requirement, most users prefer to keep their storage costs as low as possible. Disabling event.original by default, but adding the option to enable, seems like the a reasonable solution.
Could we add a switch to our Fleet packages (not Beat modules) to allow some optionality on the preservation of original events.
Related issue: elastic/beats#14708
Our current integrations are inconsistent when it comes to preserving original logs/fields. Some integrations preserve event.original, while others do not. Preserving raw logs has a significant impact on storage, often doubling the size of an event.
While there are cases whereby preservation of raw logs is a requirement, most users prefer to keep their storage costs as low as possible. Disabling event.original by default, but adding the option to enable, seems like the a reasonable solution.
Could we add a switch to our Fleet packages (not Beat modules) to allow some optionality on the preservation of original events.
Related issue: elastic/beats#14708