Skip to content

[etcd] Incorrect leader field definitions #8373

@gpop63

Description

@gpop63

Overview

In our ongoing effort to enable TSDB for etcd data streams, we've observed that the leader data stream contains incorrect field definitions.

Issue can be replicated using etcd v2 by adding at least one member to the cluster.

etcdctl member add <name> <peerURL>

Example of a leader event from beats:

"etcd": {
  "leader": {
    "follower": {
      "leader": "ce2a822cea30bfca",
      "latency": {
        "ms": 0
      },
      "failed_operations": 300,
      "id": "4ad9783cc83ba952",
      "success_operations": 0
    }
  },
  "api_version": "2"
}

Field definitions should be (fields.yml):

- name: etcd.leader
  type: group
  fields:
  - name: follower
    type: group
    description: >
      Contains follower statistics.
    fields:
      - name: id
        type: keyword
        description: ID of follower
      - name: latency
        type: group
        description: >
          Latency to each peer in the cluster
        fields:
          - name: ms
            type: scaled_float
      - name: success_operations
        type: integer
        description: successful Raft RPC requests
      - name: failed_operations
        type: integer
        description: failed Raft RPC requests
      - name: leader
        type: keyword
        description: ID of actual leader

Metadata

Metadata

Assignees

No one assigned

    Labels

    Team:Obs-InfraObsObservability Infrastructure Monitoring team [elastic/obs-infraobs-integrations]

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions