elastic / elastic/integrations
[Elastic Agent]: Map error.message in elastic_agent.filebeat dataset
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Elastic Agent [elastic_agent]
### Dataset Name
elastic_agent.filebeat
### Integration Version
8.19
### Agent Version
8.19
### OS Version and Architecture
Ubuntu 22.04
### User Goal
As an admin I need to be able to alert on integration errors based on messages in the error.message field.
As a specific example, I need to be able to see Invalid Key errors in the umbrella integration. These are currently not surfaced in the umbrella integration, and the integration does not enter an unhealthy state.
The error is available in error.message and alerts can then be built around this. This is not just umbrella specific but applies to many integrations where internal health logging is not exposed.
### Existing Features
The current elastic_agent.filebeat@package component template has dynamic mapping set to false, this means that the dynaic mapping of *.message fields to match_only_text in ecs@mappings is not executed.
This makes it impossible to search for logs where error.message exists, or to perform text searches on the field.
### What did you see?
The above is after adding a custom mapping for the field
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.