Add FORMATTER_LOGSTASH_ECS_MESSAGE_FIELD_LIST

eht16 · Jan 9, 2024 · 8297631 · 8297631
1 parent a57ffbd
commit 8297631
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/logstash_async/constants.py b/logstash_async/constants.py
@@ -44,7 +44,8 @@ class Constants:
     FORMATTER_LOGSTASH_MESSAGE_FIELD_LIST = [
         '@timestamp', '@version', 'host', 'level', 'logsource', 'message',
         'pid', 'program', 'type', 'tags', '@metadata']
-    # convert dotted ecs fields into nested objects
+    FORMATTER_LOGSTASH_ECS_MESSAGE_FIELD_LIST = ['@timestamp', '@version', '@metadata', 'message', 'labels', 'tags']
+    # convert dotted ECS fields into nested objects
     FORMATTER_LOGSTASH_ECS_NORMALIZE_MESSAGE = True
     # enable rate limiting for error messages (e.g. network errors) emitted by the logger
     # used in LogProcessingWorker, i.e. when transmitting log messages to the Logstash server.

diff --git a/logstash_async/formatter.py b/logstash_async/formatter.py
@@ -265,7 +265,7 @@ class LogstashEcsFormatter(LogstashFormatter):
     }
 
     normalize_ecs_message = constants.FORMATTER_LOGSTASH_ECS_NORMALIZE_MESSAGE
-    top_level_field_set = LogstashFormatter.top_level_field_set | set(__schema_dict.values())
+    top_level_field_set = {*constants.FORMATTER_LOGSTASH_ECS_MESSAGE_FIELD_LIST, *__schema_dict.values()}
     MessageSchema = type('MessageSchema', (LogstashFormatter.MessageSchema,), __schema_dict)
 
     def _get_primary_fields(self, record):