elastic / elastic/integrations

[Elastic Agent]: Map error.message in elastic_agent.filebeat dataset

Open
#14,975 3 comments 0 reactions 0 assignees View on GitHub
Integration:elastic_agent needs:triage Stalled Team:Elastic-Agent
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Elastic Agent [elastic_agent]

### Dataset Name

elastic_agent.filebeat

### Integration Version

8.19

### Agent Version

8.19

### OS Version and Architecture

Ubuntu 22.04

### User Goal

As an admin I need to be able to alert on integration errors based on messages in the error.message field.
As a specific example, I need to be able to see Invalid Key errors in the umbrella integration. These are currently not surfaced in the umbrella integration, and the integration does not enter an unhealthy state.

The error is available in error.message and alerts can then be built around this. This is not just umbrella specific but applies to many integrations where internal health logging is not exposed.

### Existing Features

The current elastic_agent.filebeat@package component template has dynamic mapping set to false, this means that the dynaic mapping of *.message fields to match_only_text in ecs@mappings is not executed.

This makes it impossible to search for logs where error.message exists, or to perform text searches on the field.

### What did you see?

Image

The above is after adding a custom mapping for the field

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.