elastic / elastic/logstash

Usage of required variables, "beginning with @"

Open
#4,044 10 comments 0 reactions 0 assignees View on GitHub
discuss
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

There are a set of event variables, the ones that begin with `@` that somehow are required for Logstash. Even though this fields are required in the source code, and also as a core concept of logstash, the pipeline let the user remove them (see mutate filter or remove_field in filters). If something like this happen, see #4020 for more details, then some pipelines will complain.

I think is important we set the expectations about this variables right, I see different approaches here.
- We make this fields mandatory, and make this fields impossible to be removed.
- We move the timestamp and version out of the event hash and only use them as internal variables.
- We allow this variables to be removed.

I'm on the fence on this here, I see benefits of having all options. This makes me thing that probably the best option would be the second one, by moving the `@` variables as internals the event hash is more clean, allowing both usages more out of the box.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.