-
Notifications
You must be signed in to change notification settings - Fork 522
Add aws.metrics_names_fingerprint field and mark it as a dimension #11368
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add aws.metrics_names_fingerprint field and mark it as a dimension #11368
Conversation
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
|
|
agithomas
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
packages/aws/changelog.yml
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@kaiyan-sheng I would include in the description this part you added in the issue:
For metrics coming in from Firehose, there can be cases two documents have the same timestamp, dimension, namespace, accountID, exportARN and region BUT from two different requests.
Does it cause document loss because of TSDB? I would include it.
I think it would help to navigate better when looking at the changelog in case this appears in a SDH in the future.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@constanca-m Yes it does cause document loss because of TSDB. Let me add it in the aws firehose integration since that's where the actual fingerprint processor is added: https://github.com/elastic/integrations/blob/main/packages/awsfirehose/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml#L29
changelog: https://github.com/elastic/integrations/blob/main/packages/awsfirehose/changelog.yml#L7
|
Package aws - 2.25.1 containing this change is available at https://epr.elastic.co/search?package=aws |
…11368) Add aws.metrics_names_fingerprint field and mark it as a dimension


Proposed commit message
This PR adds aws.metrics_names_fingerprint which is a hash of the list of metric names exist in each document. For metrics coming in from Firehose, there can be cases two documents have the same timestamp, dimension, namespace, accountID, exportARN and region BUT from two different requests. With adding the aws.metrics_names_fingerprint as TSDB dimension, we are able to ingest these two documents into ES.
Checklist
changelog.ymlfile.Related issues
backport #11281 to 2.25