This ticket is created as a followup of #3451
The rename processor (renaming message to event.original) in the ingest pipelines for log datastreams don't have an if/ignore_missing check
Current state:
- rename:
field: message
target_field: event.original
Expected State:
- rename:
field: message
target_field: event.original
ignore_missing: true
if: 'ctx.event?.original == null'
description: 'Renames the original message field to event.original to store a copy of the original message. The event.original field is not touched if the document already has one; it may happen when Logstash sends the document.'
Below are the Observability Integrations which need this change
Phase1 updates:
Cloud Monitoring:
Cloud Native:
Phase2 updates:
This ticket is created as a followup of #3451
The rename processor (renaming message to event.original) in the ingest pipelines for log datastreams don't have an if/ignore_missing check
Current state:
field: message
target_field: event.original
Expected State:
field: message
target_field: event.original
ignore_missing: true
if: 'ctx.event?.original == null'
description: 'Renames the original
messagefield toevent.originalto store a copy of the original message. Theevent.originalfield is not touched if the document already has one; it may happen when Logstash sends the document.'Below are the Observability Integrations which need this change
Phase1 updates:
Cloud Monitoring:
Cloud Native:
Phase2 updates:
- [ ] tomcatWill soon be deprecated.