elastic / elastic/logstash

Add configurable toggle for overwrite of fields by filters

Open
#4,837 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
1d 4h
Merged PRs (30d)
88

Description

Currently the JSON filter (and others) will overwrite a field value if that field is present in the source. In some cases this could be useful, such as when a default might be set and then overwritten by the filter, but in other cases it can result in the loss of metadata previously added to the event. It would be helpful to be able to enable or disable the overwrite of fields as an option.

Contributor guide

Open the contributing guide

Research direction

Start by locating the JSON filter and comparing the other filters referenced in the issue, since no files or tests are named. Define the option's expected default and behavior for preserving or overwriting existing fields, then verify that behavior across the affected filters.

Written by the indexing model from the issue text.

Assessment

Domain
backend, data-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.