You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Many of the recently Filebeat modules recently translated to ECS also added more integer coercion, for some of the fields that used to remain as strings (e.g. PID, port, etc).
This was done by adding :int in the grok expression, which may not be enough for all of these fields. We should review and use :long to perform the coercion where necessary.
Yes, I agree. I'm even doing that for HTTP status codes, which are very far from overflowing the capacity of a signed int. I'm going for the most straightforward approach possible: "Always use long, don't overthink it" 😂
Many of the recently Filebeat modules recently translated to ECS also added more integer coercion, for some of the fields that used to remain as strings (e.g. PID, port, etc).
This was done by adding
:int
in the grok expression, which may not be enough for all of these fields. We should review and use:long
to perform the coercion where necessary.Modules already merged, affected by this:
PRs already open, but not merged yet (should be fixed directly in their respective PRs):
This potential problem came up first here: #8963 (comment)
The text was updated successfully, but these errors were encountered: