Add aws.metrics_names_fingerprint field and mark it as a dimension#11368
Conversation
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
|
|
packages/aws/changelog.yml
Outdated
There was a problem hiding this comment.
@kaiyan-sheng I would include in the description this part you added in the issue:
For metrics coming in from Firehose, there can be cases two documents have the same timestamp, dimension, namespace, accountID, exportARN and region BUT from two different requests.
Does it cause document loss because of TSDB? I would include it.
I think it would help to navigate better when looking at the changelog in case this appears in a SDH in the future.
There was a problem hiding this comment.
@constanca-m Yes it does cause document loss because of TSDB. Let me add it in the aws firehose integration since that's where the actual fingerprint processor is added: https://github.com/elastic/integrations/blob/main/packages/awsfirehose/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml#L29
changelog: https://github.com/elastic/integrations/blob/main/packages/awsfirehose/changelog.yml#L7
|
Package aws - 2.25.1 containing this change is available at https://epr.elastic.co/search?package=aws |
…11368) Add aws.metrics_names_fingerprint field and mark it as a dimension


Proposed commit message
This PR adds aws.metrics_names_fingerprint which is a hash of the list of metric names exist in each document. For metrics coming in from Firehose, there can be cases two documents have the same timestamp, dimension, namespace, accountID, exportARN and region BUT from two different requests. With adding the aws.metrics_names_fingerprint as TSDB dimension, we are able to ingest these two documents into ES.
Checklist
changelog.ymlfile.Related issues
backport #11281 to 2.25