📝 Summary
As part of elastic/integrations#994, usages of log.original will be replaced by event.original. We should accommodate this in our message reconstruction heuristic by adding a fallback to event.original that mimics the current one to log.original.
✔️ Acceptance criteria
- A generic fallback rule to
event.original exists that behaves like the one for log.original.
- The
log.original fallback still remains for compatibility with older filebeat modules and packages.
📝 Summary
As part of elastic/integrations#994, usages of
log.originalwill be replaced byevent.original. We should accommodate this in our message reconstruction heuristic by adding a fallback toevent.originalthat mimics the current one tolog.original.✔️ Acceptance criteria
event.originalexists that behaves like the one forlog.original.log.originalfallback still remains for compatibility with older filebeat modules and packages.