Persistent ECS warning

Elastic Stack Logstash
1

logstash 8.11.3

Can anyone tell me why with the following config, and everything else at the default install, why I continue to get the [logstash.codecs.jsonlines] ECS compatibility is enabled but `target` option was not specified. This may cause fields to be set at the top-level of the event where they are likely to clash with the Elastic Common Schema. warning with every event?

Thanks. I know it's ignorable, but I'd rather it not fill my logs.

input {
  http {
    host => "0.0.0.0"
    port => 8080
    ssl => true
    ssl_certificate => "/etc/logstash/certs/blah/combined.pem"
    ssl_key => "/etc/logstash/certs/blah.pkcs8.key"
    user => "blah"
    password => "blahblah"
    codec => json_lines {
       charset => "UTF-8"
       target => "[document]"
    }
  }
}
2

Check a similar issue here

3

Ah, that did it. Thanks so much @Rios .

tl;dr it's a bug; add the top line:

    additional_codecs => {}
    codec => json {
      target => "[document]"
    }
1 Like
4

Thanks to Badger.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.