We contributed the
icinga module for Filebeat and started developing a Logstash pipeline for parsing Icinga logs: https://github.com/Icinga/icinga-logstash-pipeline. It seems like there are far too many different rules to implement them into the filebeat module or the ingestion pipeline so we opted for a Logstash pipeline containing all rules.
I'm currently trying to line up the parsing when logs come from filebeat by reading the log on the filesystem with logs that where already preprocessed by the
icinga module in filebeat. Doing this I just realized that the output of the
icinga module was changed to fit better into ECS. I know, I can but I don't have to follow the conventions of ECS when it comes to custom fields but we want to stay as compatible as possible.
Could you help me with deciding, how to build our custom fields when it comes to ECS compatibility?
A possible logevent looks like this:
[2019-10-18 09:51:07 +0200] information/RemoteCheckQueue: items: 0, rate: 0/s (18/min 90/5min 270/15min);
icinga module in Filebeat as the pipeline will remove
[2019-10-18 09:51:07 +0200] information/RemoteCheckQueue: and leave the rest as the "real" message.
The current version of the
icinga module puts
icinga.main.facility. While I like most of these changes, I don't know, what to make of the
main part. In our pipeline we just put
icinga.facility and use this for
if to determine which filters to apply. Why I already started a branch, which moves
icinga.main.facility I'm not sure how to go on from here.
- Will the name of the field be changed again? We ship dashboards with the Logstash pipeline which we have to change, too. I don't want to do this over and over again.
main? More important, what's
not-main? Should we go on with
icinga.remotecheckqueue? I don't think that's reasonable especially because we have overlapping fields in different facilities which is, what we want. (Some information can be part of several components but should end up in the same field)
- Should everything go into
icinga.main? It's easily done but I don't see a point in this.
Maybe you could shed some light on how to stay as close to ECS as possible.
We have an open issue on GitHub for this topic, too.