Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change deprecation.elasticsearch keyword to elasticsearch.deprecation #117933

Merged
merged 10 commits into from
Dec 4, 2024
2 changes: 1 addition & 1 deletion distribution/src/config/log4j2.properties
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ appender.deprecation_rolling.name = deprecation_rolling
appender.deprecation_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation.json
appender.deprecation_rolling.layout.type = ECSJsonLayout
# Intentionally follows a different pattern to above
JVerwolf marked this conversation as resolved.
Show resolved Hide resolved
appender.deprecation_rolling.layout.dataset = deprecation.elasticsearch
appender.deprecation_rolling.layout.dataset = elasticsearch.deprecation
appender.deprecation_rolling.filter.rate_limit.type = RateLimitingFilter

appender.deprecation_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation-%i.json.gz
Expand Down
17 changes: 17 additions & 0 deletions docs/changelog/117933.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
pr: 117933
summary: Change `deprecation.elasticsearch` keyword to `elasticsearch.deprecation`
area: Infra/Logging
type: "breaking"
issues: [83251]
breaking:
title: Deprecation logging value change for "data_stream.dataset" and "event.dataset"
area: Logging
details: |-
This change modifies the "data_stream.dataset" and "event.dataset" value for deprecation logging
to use the value `elasticsearch.deprecation` instead of `deprecation.elasticsearch`. This is now
consistent with other values where the name of the service is the first part of the key.
impact: |-
If you are directly consuming deprecation logs for "data_stream.dataset" and "event.dataset" and filtering on
this value, you will need to update your filters to use `elasticsearch.deprecation` instead of
`deprecation.elasticsearch`.
notable: false
Original file line number Diff line number Diff line change
Expand Up @@ -125,14 +125,14 @@ public void testDeprecatedMessageWithoutXOpaqueId() throws IOException {
jsonLogs,
contains(
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),
hasEntry("elasticsearch.node.name", "sample-name"),
hasEntry("message", "deprecated message1"),
hasEntry("data_stream.type", "logs"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasKey("ecs.version"),
hasEntry(DeprecatedMessage.KEY_FIELD_NAME, "a key"),
Expand Down Expand Up @@ -168,8 +168,8 @@ public void testCompatibleLog() throws Exception {
contains(
allOf(
hasEntry("log.level", "CRITICAL"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
Expand All @@ -186,8 +186,8 @@ public void testCompatibleLog() throws Exception {
allOf(
hasEntry("log.level", "CRITICAL"),
// event.dataset and data_stream.dataset have to be the same across the data stream
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
Expand Down Expand Up @@ -240,8 +240,8 @@ public void testParseFieldEmittingDeprecatedLogs() throws Exception {
// deprecation log for field deprecated_name
allOf(
hasEntry("log.level", "WARN"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
Expand All @@ -258,8 +258,8 @@ public void testParseFieldEmittingDeprecatedLogs() throws Exception {
// deprecation log for field deprecated_name2 (note it is not being throttled)
allOf(
hasEntry("log.level", "WARN"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
Expand All @@ -276,8 +276,8 @@ public void testParseFieldEmittingDeprecatedLogs() throws Exception {
// compatible log line
allOf(
hasEntry("log.level", "CRITICAL"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
Expand Down Expand Up @@ -327,14 +327,14 @@ public void testDeprecatedMessage() throws Exception {
jsonLogs,
contains(
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),
hasEntry("elasticsearch.node.name", "sample-name"),
hasEntry("message", "deprecated message1"),
hasEntry("data_stream.type", "logs"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasKey("ecs.version"),
hasEntry(DeprecatedMessage.KEY_FIELD_NAME, "someKey"),
Expand Down Expand Up @@ -579,7 +579,7 @@ public void testDuplicateLogMessages() throws Exception {
jsonLogs,
contains(
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),
Expand Down Expand Up @@ -612,7 +612,7 @@ public void testDuplicateLogMessages() throws Exception {
jsonLogs,
contains(
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),
Expand All @@ -622,7 +622,7 @@ public void testDuplicateLogMessages() throws Exception {
hasEntry("elasticsearch.event.category", "other")
),
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,14 +15,13 @@ appender.deprecated.name = deprecated
appender.deprecated.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecated.json
# Intentionally follows a different pattern to above
appender.deprecated.layout.type = ECSJsonLayout
appender.deprecated.layout.dataset = deprecation.elasticsearch
appender.deprecated.layout.dataset = elasticsearch.deprecation
appender.deprecated.filter.rate_limit.type = RateLimitingFilter

appender.deprecatedconsole.type = Console
appender.deprecatedconsole.name = deprecatedconsole
appender.deprecatedconsole.layout.type = ECSJsonLayout
# Intentionally follows a different pattern to above
appender.deprecatedconsole.layout.dataset = deprecation.elasticsearch
appender.deprecatedconsole.layout.dataset = elasticsearch.deprecation
appender.deprecatedconsole.filter.rate_limit.type = RateLimitingFilter


Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ private static ESLogMessage getEsLogMessage(
String messagePattern,
Object[] args
) {
ESLogMessage esLogMessage = new ESLogMessage(messagePattern, args).field("data_stream.dataset", "deprecation.elasticsearch")
ESLogMessage esLogMessage = new ESLogMessage(messagePattern, args).field("data_stream.dataset", "elasticsearch.deprecation")
.field("data_stream.type", "logs")
.field("data_stream.namespace", "default")
.field(KEY_FIELD_NAME, key)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -339,12 +339,12 @@ public void testDeprecationMessagesCanBeIndexed() throws Exception {
hasEntry("elasticsearch.event.category", "settings"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasKey("log.logger"),
hasEntry("message", "[deprecated_settings] usage is deprecated. use [settings] instead")
Expand All @@ -357,12 +357,12 @@ public void testDeprecationMessagesCanBeIndexed() throws Exception {
hasEntry("elasticsearch.event.category", "api"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/deprecated_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasKey("log.logger"),
hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")
Expand Down Expand Up @@ -402,12 +402,12 @@ public void testDeprecationCriticalWarnMessagesCanBeIndexed() throws Exception {
hasEntry("elasticsearch.event.category", "settings"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_critical_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasKey("log.logger"),
hasEntry("message", "[deprecated_settings] usage is deprecated. use [settings] instead")
Expand Down Expand Up @@ -443,12 +443,12 @@ public void testDeprecationWarnMessagesCanBeIndexed() throws Exception {
hasEntry("elasticsearch.event.category", "settings"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_warn_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasKey("log.logger"),
hasEntry("message", "[deprecated_warn_settings] usage is deprecated but won't be breaking in next version")
Expand All @@ -461,12 +461,12 @@ public void testDeprecationWarnMessagesCanBeIndexed() throws Exception {
hasEntry("elasticsearch.event.category", "api"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/deprecated_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasKey("log.logger"),
hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")
Expand Down Expand Up @@ -619,12 +619,12 @@ public void testCompatibleMessagesCanBeIndexed() throws Exception {
hasEntry("elasticsearch.event.category", "compatible_api"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "compatible_key"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasKey("log.logger"),
hasEntry("message", "You are using a compatible API for this request")
Expand All @@ -637,12 +637,12 @@ public void testCompatibleMessagesCanBeIndexed() throws Exception {
hasEntry("elasticsearch.event.category", "compatible_api"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/compat_only"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasKey("log.logger"),
hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ private DeprecationIndexingComponent(
final Configuration configuration = context.getConfiguration();

final EcsLayout ecsLayout = ECSJsonLayout.newBuilder()
.setDataset("deprecation.elasticsearch")
.setDataset("elasticsearch.deprecation")
.setConfiguration(configuration)
.build();

Expand Down