Rename took_in_nanos to event.duration for the JSON logs as well.

elastic · Jan 11, 2019 · d503db9 · d503db9
1 parent 95b8cc5
commit d503db9
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/filebeat/module/logstash/slowlog/ingest/pipeline-json.json b/filebeat/module/logstash/slowlog/ingest/pipeline-json.json
@@ -51,7 +51,7 @@
         {
             "rename": {
                 "field": "logstash.slowlog.logEvent.took_in_nanos",
-                "target_field": "logstash.slowlog.took_in_nanos"
+                "target_field": "event.duration"
             }
         },
         {

diff --git a/filebeat/module/logstash/slowlog/test/slowlog-json.log-expected.json b/filebeat/module/logstash/slowlog/test/slowlog-json.log-expected.json
@@ -3,6 +3,7 @@
         "@timestamp": "2019-01-08T14:58:35.605Z",
         "ecs.version": "1.0.0-beta2",
         "event.dataset": "logstash.slowlog",
+        "event.duration": 5026401704,
         "event.module": "logstash",
         "fileset.name": "slowlog",
         "input.type": "log",
@@ -15,7 +16,6 @@
         "logstash.slowlog.plugin_params_object.id": "9746eeec777fcb4c7ea30366dab5445873a8560b7f1766ee1272e59b08d731fb",
         "logstash.slowlog.plugin_type": "filters",
         "logstash.slowlog.thread": "Ruby-0-Thread-6: :1",
-        "logstash.slowlog.took_in_millis": 5026,
-        "logstash.slowlog.took_in_nanos": 5026401704
+        "logstash.slowlog.took_in_millis": 5026
     }
 ]