We have a setup where we ship logs between systems via logstash to logstash using http plugins. The access logs are in ecs format. The problem is, logstash overwrites http, url and others fields, with it's own transport information. Can this be solved without renaming original fields before sending, and then again after receiving?
You may disable the ecs_compatibility in the receiving logstash, but other fields, like host and headers will be overwritten as explained in the documentation.
I don't think this can be disabled, at least there is nothing in the documentation about it.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.