I have some question. I upgraded my ELK to 7.16.1 due to a Log4j2 security issue.
In my logstash configuration, we are using to get input from Azure EventHub and Kubernetes cluster.
after upgraded my ELK I am getting huge amount of WARN logs in logstash about:
[WARN ][deprecation.logstash.codecs.plain][main][192d4ff28a8bbed04078f9f42501af310049e890b5122bc26451fd524fa2cd78] Relying on default value of pipeline.ecs_compatibility, which may change in a future major release of Logstash. To avoid unexpected changes when upgrading Logstash, please explicitly declare your desired ECS Compatibility mode.
In the internet I just found that I need to add: ecs_compatibility => disabled in each output section.
for example:
if "nginx-geoip" in [tags] {
elasticsearch {
hosts => [" elasticsearch-client.es .svc.cluster.local:9200"]
manage_template => true
index => "logstash-nginx-geoip-%{+YYYY.MM.dd}"
ecs_compatibility => disabled
}
}
I added it but I still get this WARN every sec. Does someone maybe know how to resolve/ignore from those WARNs?
The log message occurs during plugin startup, for any plugin attempting to determine what mode it should be initialized in (not just output plugins), when neither the plugin or the pipeline that it is run in declare what mode it should be run in. To silence the deprecation warning for an entire pipeline, you can address it by setting the pipeline-level setting. The value disabled locks in the current default behaviour.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.