[
https://issues.apache.org/jira/browse/FLUME-2220?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13806998#comment-13806998
]
Dib Ghosh commented on FLUME-2220:
----------------------------------
Thanks Rotem for the patch. Looks fine to me. Now please wait for a flume
contributor / committer to review it.
Meanwhile, I downloaded the diff file from reviewboard and attached it with the
JIRA ticket as per flume patch submission process. Hope you won't mind me
uploading the patch to the JIRA. Also marking the JIRA ticket to patch
available.
Best,
- dib
> ElasticSearch sink - duplicate fields in indexed document
> ---------------------------------------------------------
>
> Key: FLUME-2220
> URL: https://issues.apache.org/jira/browse/FLUME-2220
> Project: Flume
> Issue Type: Bug
> Affects Versions: v1.4.0
> Reporter: Rotem Hermon
> Priority: Minor
> Labels: ElasticSearch, sink
> Fix For: v1.5.0
>
> Attachments: FLUME-2220.patch
>
>
> The default serializer for the ElasticSearch sink
> (ElasticSearchLogStashEventSerializer) duplicates fields that are mapped to
> default logstash fields.
> For instance timestamp, source, host. Those appear both as logstash fields
> ("@timestamp", "@source_host" etc.), and both as fields under the @fields
> ("@fields.timestamp", "@fields.host").
> When inserting a field from the headers as a logstash system field it should
> be removed from the dictionary so it wouldn't get written again under the
> "@fields" field.
--
This message was sent by Atlassian JIRA
(v6.1#6144)
