'source_ip_fieldname' is user customized, please check is has an ECS compatible name

Elastic Stack Logstash
1

Hello Elastic community,

After migrating to Logstash 8 i have found a new warning message like

[WARN ][logstash.inputs.udp ] 'source_ip_fieldname' is user customized, please check is has an ECS compatible name


    udp{
        port =>514
        type =>syslog
        source_ip_fieldname =>"[@metadata][ip_address]"
    }

How to resolve it? What is the issue here?

2

Hi @Mahesh_Kumar_S ,

It is likely that the warning refers to not following the ECS naming conventions. The recommendation from Logstash is to use ECS-compliant field names to ensure that your data is well-structured and can be used consistently across various parts of the Elastic Stack (such as Elasticsearch and Kibana).

You can try using ECS conventions, for example: Source Fields | Elastic Common Schema (ECS) Reference [8.11] | Elastic

For instance, try using source.ip instead of source_ip_fieldname => "[@metadata][ip_address]":



udp {
    port => 514
    type => syslog
    source_ip_fieldname => "[source][ip]"
}
1 Like