I am not understanding the ecs changes in the logstash elasticsearch output plugin version 7.9 ecs compatibility.
I have an issue when I try to index an event that has an object mapping for host.
object mapping for [host] tried to parse field [host] as object
I know this is a common error in logstash
My question is does logstash output plugin version 7.10 fix this problem or is this something I need to do in my logstash pipelines?
From 7.10 documentation
This plugin will persist events to Elasticsearch in the shape produced by your pipeline, and cannot be used to re-shape the event structure into a shape that complies with ECS. To produce events that fully comply with ECS, you will need to populate ECS-defined fields throughout your pipeline definition.
Can anyone interpret this language to a more layman's terms?
does this mean that if filebeat sets host to object any event with host as non-object will still be rejected?