Update Thrift protocol to use ECS fields #10125
Conversation
That dashboard was updated too. Here's a summary of what fields changed. Part of elastic#7968 Changed - bytes_in -> source.bytes - bytes_out -> destination.bytes - notes -> error.message - responsetime -> event.duration (unit are now nanoseconds) Added - source - destination - event.dataset = thrift - event.end - event.start - network.community_id - network.transport = tcp - network.protocol = thrift - network.bytes - network.type Unchanged Packetbeat Fields - method - path - query - status - type = thrift (we might remove this since we have event.dataset)
andrewkroh
force-pushed
the
feature/pb/thrift-ecs
branch
from
00d2576
to
d7e73fc
Compare
| @@ -1130,22 +1137,15 @@ func (thrift *thriftPlugin) publishTransactions() { | |||
| t.reply.exceptions) | |||
| } | |||
| } | |||
| if len(t.reply.notes) > 0 { | |||
| fields["notes"] = t.reply.notes | |||
| if len(t.reply.notes) == 1 { | |||
There was a problem hiding this comment.
This becomes a pattern across protocols :-)
| assert all([o["source.bytes"] > 0 for o in objs]) | ||
| assert all([o["destination.bytes"] > 0 for o in objs[0:14]]) | ||
| assert all([o["destination.bytes"] > 0 for o in objs[16:]]) | ||
| #assert objs[14]["destination.bytes"] == 0 |
There was a problem hiding this comment.
Commeted out on purpose? Also 2 more below.
There was a problem hiding this comment.
Zero values are automatically omitted based on how I marshaling these fields. Effectively it's like json:"destination.bytes,omitempty". I meant to remove these lines. Will fix.
There was a problem hiding this comment.
LGTM if the comments noted by Nic were there on purpose.
One note: populating error.message is fine with me, I think this is how it should be used. Ingest Node suggests in its documentation to output IN errors at error.message as well, though. So far, it looks like people always cargo cult that part, I've never seen a pipeline that put IN's error message elsewhere.
Packetbeat doesn't use Ingest Node, correct? If that's true, I think we're good here.
The zero value fields are automatically removed from the resulting event.
That's correct. And Packetbeat is using |
That dashboard was updated too.
Here's a summary of what fields changed.
Part of #7968
Changed
Added
Unchanged Packetbeat Fields