NETWAYS / NETWAYS/postfix-logstash-pipeline
Find a better solution for address/ip/domain
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
We have all three fields for client and server. ECS says, .address has to be set. If there's an IP address in that field, copy it into .ip and if it's a FQDN, copy it into .domain.
The problem we have is that sometimes one is set but the other is not. Or both are set. Or one is set to a dummy value like unkown or while the other has a valid value. The current implementation tries to always use the most meaningful information for .address but this ends up different values in address depending on what log event it is.
We could work around it in Kibana by never using .address but I'm not sure if that's feasible. I'm opening this issue to search for a better solution to this problem.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the current address, IP, and domain handling in the Logstash pipeline and the ECS requirement that address be populated. Compare the possible combinations of valid and dummy values described in the issue, then document an agreed rule for consistent field mapping. Done means the project has a decided solution rather than an unresolved search for alternatives.
Written by the indexing model from the issue text.
Assessment
- Domain
- data-engineering
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100