fix: mutate logstash host to object before sending it to elastic

opencrvs · Sep 5, 2024 · 4475f46 · 4475f46
1 parent aa84a6c
commit 4475f46
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/infrastructure/monitoring/logstash/logstash.conf b/infrastructure/monitoring/logstash/logstash.conf
@@ -10,6 +10,13 @@ filter {
         # container_id, but Kibana and other tools read from container.id by default
         rename => {"container_id" => "container.id"}
     }
+    # As of V8, Elasticsearch JSON logs now comply with ECS. [host] becomes object
+    mutate {
+        rename {
+            "[host]" => "[host][name]"
+        }
+    }
+
     truncate {
         length_bytes => 12
         fields => ["container.id"]