Change deprecation.elasticsearch keyword to elasticsearch.deprecation (…

…elastic#117933) Changes the values of the "data_stream.dataset" and "event.dataset" fields to be "elasticsearch.deprecation" instead of "deprecation.elasticsearch".
stefnestor · Dec 4, 2024 · b716a53 · b716a53
1 parent 774c6ea
commit b716a53
Show file tree

Hide file tree

Showing 7 changed files with 54 additions and 37 deletions.
diff --git a/distribution/src/config/log4j2.properties b/distribution/src/config/log4j2.properties
@@ -63,7 +63,7 @@ appender.deprecation_rolling.name = deprecation_rolling
 appender.deprecation_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation.json
 appender.deprecation_rolling.layout.type = ECSJsonLayout
 # Intentionally follows a different pattern to above
-appender.deprecation_rolling.layout.dataset = deprecation.elasticsearch
+appender.deprecation_rolling.layout.dataset = elasticsearch.deprecation
 appender.deprecation_rolling.filter.rate_limit.type = RateLimitingFilter
 
 appender.deprecation_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation-%i.json.gz

diff --git a/docs/changelog/117933.yaml b/docs/changelog/117933.yaml
@@ -0,0 +1,18 @@
+pr: 117933
+summary: Change `deprecation.elasticsearch` keyword to `elasticsearch.deprecation`
+area: Infra/Logging
+type: bug
+issues:
+ - 83251
+breaking:
+  title: Deprecation logging value change for "data_stream.dataset" and "event.dataset"
+  area: Logging
+  details: |-
+    This change modifies the "data_stream.dataset" and "event.dataset" value for deprecation logging
+    to use the value `elasticsearch.deprecation` instead of `deprecation.elasticsearch`. This is now
+    consistent with other values where the name of the service is the first part of the key.
+  impact: |-
+    If you are directly consuming deprecation logs for "data_stream.dataset" and "event.dataset" and filtering on
+    this value, you will need to update your filters to use `elasticsearch.deprecation` instead of
+    `deprecation.elasticsearch`.
+  notable: false
diff --git a/qa/logging-config/src/test/java/org/elasticsearch/common/logging/JsonLoggerTests.java b/qa/logging-config/src/test/java/org/elasticsearch/common/logging/JsonLoggerTests.java
@@ -125,14 +125,14 @@ public void testDeprecatedMessageWithoutXOpaqueId() throws IOException {
                 jsonLogs,
                 contains(
                     allOf(
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "CRITICAL"),
                         hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                         hasEntry("elasticsearch.cluster.name", "elasticsearch"),
                         hasEntry("elasticsearch.node.name", "sample-name"),
                         hasEntry("message", "deprecated message1"),
                         hasEntry("data_stream.type", "logs"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasKey("ecs.version"),
                         hasEntry(DeprecatedMessage.KEY_FIELD_NAME, "a key"),
@@ -168,8 +168,8 @@ public void testCompatibleLog() throws Exception {
                     contains(
                         allOf(
                             hasEntry("log.level", "CRITICAL"),
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
@@ -186,8 +186,8 @@ public void testCompatibleLog() throws Exception {
                         allOf(
                             hasEntry("log.level", "CRITICAL"),
                             // event.dataset and data_stream.dataset have to be the same across the data stream
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
@@ -240,8 +240,8 @@ public void testParseFieldEmittingDeprecatedLogs() throws Exception {
                         // deprecation log for field deprecated_name
                         allOf(
                             hasEntry("log.level", "WARN"),
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
@@ -258,8 +258,8 @@ public void testParseFieldEmittingDeprecatedLogs() throws Exception {
                         // deprecation log for field deprecated_name2 (note it is not being throttled)
                         allOf(
                             hasEntry("log.level", "WARN"),
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
@@ -276,8 +276,8 @@ public void testParseFieldEmittingDeprecatedLogs() throws Exception {
                         // compatible log line
                         allOf(
                             hasEntry("log.level", "CRITICAL"),
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasEntry("data_stream.type", "logs"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
@@ -327,14 +327,14 @@ public void testDeprecatedMessage() throws Exception {
                     jsonLogs,
                     contains(
                         allOf(
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
                             hasEntry("log.level", "WARN"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                             hasEntry("elasticsearch.cluster.name", "elasticsearch"),
                             hasEntry("elasticsearch.node.name", "sample-name"),
                             hasEntry("message", "deprecated message1"),
                             hasEntry("data_stream.type", "logs"),
-                            hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                            hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                             hasEntry("data_stream.namespace", "default"),
                             hasKey("ecs.version"),
                             hasEntry(DeprecatedMessage.KEY_FIELD_NAME, "someKey"),
@@ -579,7 +579,7 @@ public void testDuplicateLogMessages() throws Exception {
                     jsonLogs,
                     contains(
                         allOf(
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
                             hasEntry("log.level", "CRITICAL"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                             hasEntry("elasticsearch.cluster.name", "elasticsearch"),
@@ -612,7 +612,7 @@ public void testDuplicateLogMessages() throws Exception {
                     jsonLogs,
                     contains(
                         allOf(
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
                             hasEntry("log.level", "CRITICAL"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                             hasEntry("elasticsearch.cluster.name", "elasticsearch"),
@@ -622,7 +622,7 @@ public void testDuplicateLogMessages() throws Exception {
                             hasEntry("elasticsearch.event.category", "other")
                         ),
                         allOf(
-                            hasEntry("event.dataset", "deprecation.elasticsearch"),
+                            hasEntry("event.dataset", "elasticsearch.deprecation"),
                             hasEntry("log.level", "CRITICAL"),
                             hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
                             hasEntry("elasticsearch.cluster.name", "elasticsearch"),

diff --git a/...-config/src/test/resources/org/elasticsearch/common/logging/json_layout/log4j2.properties b/...-config/src/test/resources/org/elasticsearch/common/logging/json_layout/log4j2.properties
@@ -15,14 +15,13 @@ appender.deprecated.name = deprecated
 appender.deprecated.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecated.json
 # Intentionally follows a different pattern to above
 appender.deprecated.layout.type = ECSJsonLayout
-appender.deprecated.layout.dataset = deprecation.elasticsearch
+appender.deprecated.layout.dataset = elasticsearch.deprecation
 appender.deprecated.filter.rate_limit.type = RateLimitingFilter
 
 appender.deprecatedconsole.type = Console
 appender.deprecatedconsole.name = deprecatedconsole
 appender.deprecatedconsole.layout.type = ECSJsonLayout
-# Intentionally follows a different pattern to above
-appender.deprecatedconsole.layout.dataset = deprecation.elasticsearch
+appender.deprecatedconsole.layout.dataset = elasticsearch.deprecation
 appender.deprecatedconsole.filter.rate_limit.type = RateLimitingFilter
 
 

diff --git a/server/src/main/java/org/elasticsearch/common/logging/DeprecatedMessage.java b/server/src/main/java/org/elasticsearch/common/logging/DeprecatedMessage.java
@@ -57,7 +57,7 @@ private static ESLogMessage getEsLogMessage(
         String messagePattern,
         Object[] args
     ) {
-        ESLogMessage esLogMessage = new ESLogMessage(messagePattern, args).field("data_stream.dataset", "deprecation.elasticsearch")
+        ESLogMessage esLogMessage = new ESLogMessage(messagePattern, args).field("data_stream.dataset", "elasticsearch.deprecation")
             .field("data_stream.type", "logs")
             .field("data_stream.namespace", "default")
             .field(KEY_FIELD_NAME, key)

diff --git a/.../qa/rest/src/javaRestTest/java/org/elasticsearch/xpack/deprecation/DeprecationHttpIT.java b/.../qa/rest/src/javaRestTest/java/org/elasticsearch/xpack/deprecation/DeprecationHttpIT.java
@@ -339,12 +339,12 @@ public void testDeprecationMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "settings"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "WARN"),
                         hasKey("log.logger"),
                         hasEntry("message", "[deprecated_settings] usage is deprecated. use [settings] instead")
@@ -357,12 +357,12 @@ public void testDeprecationMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "api"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/deprecated_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "WARN"),
                         hasKey("log.logger"),
                         hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")
@@ -402,12 +402,12 @@ public void testDeprecationCriticalWarnMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "settings"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_critical_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "CRITICAL"),
                         hasKey("log.logger"),
                         hasEntry("message", "[deprecated_settings] usage is deprecated. use [settings] instead")
@@ -443,12 +443,12 @@ public void testDeprecationWarnMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "settings"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_warn_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "WARN"),
                         hasKey("log.logger"),
                         hasEntry("message", "[deprecated_warn_settings] usage is deprecated but won't be breaking in next version")
@@ -461,12 +461,12 @@ public void testDeprecationWarnMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "api"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/deprecated_settings"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "WARN"),
                         hasKey("log.logger"),
                         hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")
@@ -619,12 +619,12 @@ public void testCompatibleMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "compatible_api"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "compatible_key"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "CRITICAL"),
                         hasKey("log.logger"),
                         hasEntry("message", "You are using a compatible API for this request")
@@ -637,12 +637,12 @@ public void testCompatibleMessagesCanBeIndexed() throws Exception {
                         hasEntry("elasticsearch.event.category", "compatible_api"),
                         hasKey("elasticsearch.node.id"),
                         hasKey("elasticsearch.node.name"),
-                        hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
+                        hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
                         hasEntry("data_stream.namespace", "default"),
                         hasEntry("data_stream.type", "logs"),
                         hasKey("ecs.version"),
                         hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/compat_only"),
-                        hasEntry("event.dataset", "deprecation.elasticsearch"),
+                        hasEntry("event.dataset", "elasticsearch.deprecation"),
                         hasEntry("log.level", "CRITICAL"),
                         hasKey("log.logger"),
                         hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")

diff --git a/...c/main/java/org/elasticsearch/xpack/deprecation/logging/DeprecationIndexingComponent.java b/...c/main/java/org/elasticsearch/xpack/deprecation/logging/DeprecationIndexingComponent.java
@@ -91,7 +91,7 @@ private DeprecationIndexingComponent(
         final Configuration configuration = context.getConfiguration();
 
         final EcsLayout ecsLayout = ECSJsonLayout.newBuilder()
-            .setDataset("deprecation.elasticsearch")
+            .setDataset("elasticsearch.deprecation")
             .setConfiguration(configuration)
             .build();