[8.19] 🌊 Streams: Normalized format for wired streams (#205113)#221778
Merged
flash1293 merged 3 commits intoelastic:8.19from Jun 2, 2025
Merged
[8.19] 🌊 Streams: Normalized format for wired streams (#205113)#221778flash1293 merged 3 commits intoelastic:8.19from
flash1293 merged 3 commits intoelastic:8.19from
Conversation
This PR extends streams to allow mixed otel/ecs querying. Walkthrough (slightly outdated): https://github.com/user-attachments/assets/9d6280ff-57b2-43d8-9c81-dfbfabb64585 <img width="492" alt="Screenshot 2025-03-07 at 17 15 27" src="https://github.com/user-attachments/assets/792fbbc2-6cbe-42fe-96b3-eea2b6959fe5" /> # To test * Start up PR, enable streams via `POST kbn:/api/streams/_enable` * Redirect all incoming logs to streams: ``` PUT _ingest/pipeline/logs@custom { "processors": [ { "reroute": { "destination": "logs" } } ] } ``` * Send some logs * They will be trandslated to namespaced ECS and can be queried the same way Some demo actions: ``` # Make sure trial license is active (because of synthetic source) # Enable streams POST kbn:/api/streams/_enable # Fork some data to be able to edit mapping and stuff POST kbn:/api/streams/logs/_fork { "stream": { "name": "logs.child" }, "if": { "field": "attributes.custom_field", "operator": "exists" } } # Routing could have been done on "custom_field" as well # Send some ECS-formatted data POST logs/_doc { "message": "Hello world", "log.level": "warn", "host": { "name": "my-mbp", "ip": "1.2.3.4" }, "custom_field": "value2" } # Send some OTel-formatted data POST logs/_doc { "body": { "text": "Hello OTEL world" }, "severity_text": "warn", "resource": { "attributes": { "host.name": "my-mbp", "host.ip": "1.2.3.4" } }, "attributes": { "custom_field": "value" } } # See how it's stored as namespaced ECS (beware automatic aliasing) GET logs.child/_search # See the fields and their aliases GET kbn:/api/streams/logs.child # Nested data treatment (objects flattened, arrays kept) POST logs/_doc { "message": "Hello world", "log.level": "warn", "host": { "name": "my-mbp", "ip": "1.2.3.4" }, "custom_field": "value2", "nested_custom_field": { "deeply": { "deeply": { "nested": "value" } } }, "array_values": [ { "deeply": { "nested": 123 }}, { "deeply": { "nested": 456 }} ] } GET logs.child/_search # Map a field (show alias in app) PUT kbn:/api/streams/logs.child/_ingest { "ingest": { "lifecycle": { "inherit": {} }, "processing": [], "routing": [], "wired": { "fields": { "attributes.custom_value": { "type": "keyword" } } } } } # Trying to map "custom_value" will result in an error - only attributes.* and resource_attributes.* can be mapped # End experiment POST kbn:/api/streams/_disable ``` ## Do on separate PRs * More dedicated integration tests * Replace the painless implementation of normalization with an Elasticsearch processor (not shipped yet) * Remove the dot expander processors once Elasticsearch allows accessing flattened field names --------- Co-authored-by: Chris Cowan <chris@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 440aeab) # Conflicts: # x-pack/test/api_integration/deployment_agnostic/apis/observability/streams/enrichment.ts
tonyghiani
approved these changes
Jun 2, 2025
Contributor
💚 Build Succeeded
Metrics [docs]Module Count
Public APIs missing comments
Async chunks
Public APIs missing exports
History
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport
This will backport the following commits from
mainto8.19:Questions ?
Please refer to the Backport tool documentation