elastic / elastic/ecs

event.original in splitted events

Open
#479 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.1k
Forks
455
Avg merge
17h 8m
Merged PRs (30d)
5

Description

I noticed there is no official solution to handle event.original in case of splitted events. If Logstash splits the event (split filter), the event.original field can be duplicated to many events. This makes hard for further integrity checks or reindexing or ... So there should be some special field for keeping "number of splits or number of copies". Or just tag like "splitted.copy"?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.