Skip to content

Add checks to rename processor for the message field for all Observability Integrations #7822

Closed
@ishleenk17

Description

@ishleenk17

This ticket is created as a followup of #3451
The rename processor (renaming message to event.original) in the ingest pipelines for log datastreams don't have an if/ignore_missing check

Current state:

  • rename:
    field: message
    target_field: event.original

Expected State:

  • rename:
    field: message
    target_field: event.original
    ignore_missing: true
    if: 'ctx.event?.original == null'
    description: 'Renames the original message field to event.original to store a copy of the original message. The event.original field is not touched if the document already has one; it may happen when Logstash sends the document.'

Below are the Observability Integrations which need this change

Phase1 updates:

Cloud Monitoring:

Cloud Native:

Phase2 updates:

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions