Change deprecation.elasticsearch keyword to elasticsearch.deprecation (#117933)

Changes the values of the "data_stream.dataset" and "event.dataset" fields to be "elasticsearch.deprecation" instead of "deprecation.elasticsearch".
This commit is contained in:
John Verwolf 2024-12-04 10:25:51 -08:00 committed by GitHub
parent 774c6ea174
commit b716a53084
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 54 additions and 37 deletions

View file

@ -63,7 +63,7 @@ appender.deprecation_rolling.name = deprecation_rolling
appender.deprecation_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation.json
appender.deprecation_rolling.layout.type = ECSJsonLayout
# Intentionally follows a different pattern to above
appender.deprecation_rolling.layout.dataset = deprecation.elasticsearch
appender.deprecation_rolling.layout.dataset = elasticsearch.deprecation
appender.deprecation_rolling.filter.rate_limit.type = RateLimitingFilter
appender.deprecation_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation-%i.json.gz

View file

@ -0,0 +1,18 @@
pr: 117933
summary: Change `deprecation.elasticsearch` keyword to `elasticsearch.deprecation`
area: Infra/Logging
type: bug
issues:
- 83251
breaking:
title: Deprecation logging value change for "data_stream.dataset" and "event.dataset"
area: Logging
details: |-
This change modifies the "data_stream.dataset" and "event.dataset" value for deprecation logging
to use the value `elasticsearch.deprecation` instead of `deprecation.elasticsearch`. This is now
consistent with other values where the name of the service is the first part of the key.
impact: |-
If you are directly consuming deprecation logs for "data_stream.dataset" and "event.dataset" and filtering on
this value, you will need to update your filters to use `elasticsearch.deprecation` instead of
`deprecation.elasticsearch`.
notable: false

View file

@ -125,14 +125,14 @@ public class JsonLoggerTests extends ESTestCase {
jsonLogs,
contains(
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),
hasEntry("elasticsearch.node.name", "sample-name"),
hasEntry("message", "deprecated message1"),
hasEntry("data_stream.type", "logs"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasKey("ecs.version"),
hasEntry(DeprecatedMessage.KEY_FIELD_NAME, "a key"),
@ -168,8 +168,8 @@ public class JsonLoggerTests extends ESTestCase {
contains(
allOf(
hasEntry("log.level", "CRITICAL"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
@ -186,8 +186,8 @@ public class JsonLoggerTests extends ESTestCase {
allOf(
hasEntry("log.level", "CRITICAL"),
// event.dataset and data_stream.dataset have to be the same across the data stream
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
@ -240,8 +240,8 @@ public class JsonLoggerTests extends ESTestCase {
// deprecation log for field deprecated_name
allOf(
hasEntry("log.level", "WARN"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
@ -258,8 +258,8 @@ public class JsonLoggerTests extends ESTestCase {
// deprecation log for field deprecated_name2 (note it is not being throttled)
allOf(
hasEntry("log.level", "WARN"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
@ -276,8 +276,8 @@ public class JsonLoggerTests extends ESTestCase {
// compatible log line
allOf(
hasEntry("log.level", "CRITICAL"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasEntry("log.logger", "org.elasticsearch.deprecation.xcontent.ParseField"),
@ -327,14 +327,14 @@ public class JsonLoggerTests extends ESTestCase {
jsonLogs,
contains(
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),
hasEntry("elasticsearch.node.name", "sample-name"),
hasEntry("message", "deprecated message1"),
hasEntry("data_stream.type", "logs"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasKey("ecs.version"),
hasEntry(DeprecatedMessage.KEY_FIELD_NAME, "someKey"),
@ -579,7 +579,7 @@ public class JsonLoggerTests extends ESTestCase {
jsonLogs,
contains(
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),
@ -612,7 +612,7 @@ public class JsonLoggerTests extends ESTestCase {
jsonLogs,
contains(
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),
@ -622,7 +622,7 @@ public class JsonLoggerTests extends ESTestCase {
hasEntry("elasticsearch.event.category", "other")
),
allOf(
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasEntry("log.logger", "org.elasticsearch.deprecation.test"),
hasEntry("elasticsearch.cluster.name", "elasticsearch"),

View file

@ -15,14 +15,13 @@ appender.deprecated.name = deprecated
appender.deprecated.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecated.json
# Intentionally follows a different pattern to above
appender.deprecated.layout.type = ECSJsonLayout
appender.deprecated.layout.dataset = deprecation.elasticsearch
appender.deprecated.layout.dataset = elasticsearch.deprecation
appender.deprecated.filter.rate_limit.type = RateLimitingFilter
appender.deprecatedconsole.type = Console
appender.deprecatedconsole.name = deprecatedconsole
appender.deprecatedconsole.layout.type = ECSJsonLayout
# Intentionally follows a different pattern to above
appender.deprecatedconsole.layout.dataset = deprecation.elasticsearch
appender.deprecatedconsole.layout.dataset = elasticsearch.deprecation
appender.deprecatedconsole.filter.rate_limit.type = RateLimitingFilter

View file

@ -57,7 +57,7 @@ public class DeprecatedMessage {
String messagePattern,
Object[] args
) {
ESLogMessage esLogMessage = new ESLogMessage(messagePattern, args).field("data_stream.dataset", "deprecation.elasticsearch")
ESLogMessage esLogMessage = new ESLogMessage(messagePattern, args).field("data_stream.dataset", "elasticsearch.deprecation")
.field("data_stream.type", "logs")
.field("data_stream.namespace", "default")
.field(KEY_FIELD_NAME, key)

View file

@ -339,12 +339,12 @@ public class DeprecationHttpIT extends ESRestTestCase {
hasEntry("elasticsearch.event.category", "settings"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasKey("log.logger"),
hasEntry("message", "[deprecated_settings] usage is deprecated. use [settings] instead")
@ -357,12 +357,12 @@ public class DeprecationHttpIT extends ESRestTestCase {
hasEntry("elasticsearch.event.category", "api"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/deprecated_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasKey("log.logger"),
hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")
@ -402,12 +402,12 @@ public class DeprecationHttpIT extends ESRestTestCase {
hasEntry("elasticsearch.event.category", "settings"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_critical_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasKey("log.logger"),
hasEntry("message", "[deprecated_settings] usage is deprecated. use [settings] instead")
@ -443,12 +443,12 @@ public class DeprecationHttpIT extends ESRestTestCase {
hasEntry("elasticsearch.event.category", "settings"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_warn_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasKey("log.logger"),
hasEntry("message", "[deprecated_warn_settings] usage is deprecated but won't be breaking in next version")
@ -461,12 +461,12 @@ public class DeprecationHttpIT extends ESRestTestCase {
hasEntry("elasticsearch.event.category", "api"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/deprecated_settings"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "WARN"),
hasKey("log.logger"),
hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")
@ -619,12 +619,12 @@ public class DeprecationHttpIT extends ESRestTestCase {
hasEntry("elasticsearch.event.category", "compatible_api"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "compatible_key"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasKey("log.logger"),
hasEntry("message", "You are using a compatible API for this request")
@ -637,12 +637,12 @@ public class DeprecationHttpIT extends ESRestTestCase {
hasEntry("elasticsearch.event.category", "compatible_api"),
hasKey("elasticsearch.node.id"),
hasKey("elasticsearch.node.name"),
hasEntry("data_stream.dataset", "deprecation.elasticsearch"),
hasEntry("data_stream.dataset", "elasticsearch.deprecation"),
hasEntry("data_stream.namespace", "default"),
hasEntry("data_stream.type", "logs"),
hasKey("ecs.version"),
hasEntry(KEY_FIELD_NAME, "deprecated_route_GET_/_test_cluster/compat_only"),
hasEntry("event.dataset", "deprecation.elasticsearch"),
hasEntry("event.dataset", "elasticsearch.deprecation"),
hasEntry("log.level", "CRITICAL"),
hasKey("log.logger"),
hasEntry("message", "[/_test_cluster/deprecated_settings] exists for deprecated tests")

View file

@ -91,7 +91,7 @@ public class DeprecationIndexingComponent extends AbstractLifecycleComponent imp
final Configuration configuration = context.getConfiguration();
final EcsLayout ecsLayout = ECSJsonLayout.newBuilder()
.setDataset("deprecation.elasticsearch")
.setDataset("elasticsearch.deprecation")
.setConfiguration(configuration)
.build();