apm-server icon indicating copy to clipboard operation
apm-server copied to clipboard

Define `ecs.version` as a `constant_keyword` field

Open axw opened this issue 3 years ago • 2 comments

We set ecs.version using a model processor, in the apm-server code, based on the version of the github.com/elastic/ecs/code/go/ecs module in use:

https://github.com/elastic/apm-server/blob/0c6c95ff8d6fb81a32ebf38420016b7d6ba765c2/internal/beater/processors.go#L64-L72

An older version of APM Server may send documents to the data streams, and the ingest pipeline is responsible for upgrading/transforming documents to the appropriate format. Therefore I believe it makes sense for the ECS version to be set by the installed ingest pipeline and index template. We can do this by making ecs.version a constant_keyword field.

This will also allow the code to be simplified, and documents to be made (slightly) smaller.

axw avatar Sep 06 '22 01:09 axw

the ingest pipeline is responsible for upgrading/transforming documents to the appropriate format.

Would this issue also contain the work to put the ingest pipeline for adding the ECS version in place?

simitt avatar Sep 14 '22 11:09 simitt

Would this issue also contain the work to put the ingest pipeline for adding the ECS version in place?

I think all we need to do is:

  • set ecs.version to a constant_keyword field in each data stream's ecs.yml file, and specify the constant value
  • stop setting ecs.version in documents sent to Elasticsearch

axw avatar Sep 14 '22 13:09 axw