Matt Wise created FLUME-2838:
--------------------------------
Summary: Syslog Sinks use 'flume.syslog.status' header which
breaks in ElasticSearch 2.0
Key: FLUME-2838
URL: https://issues.apache.org/jira/browse/FLUME-2838
Project: Flume
Issue Type: Bug
Components: Sinks+Sources
Affects Versions: v1.6.0
Reporter: Matt Wise
The EVENT_STATUS header is written to a header named 'flume.syslog.status' --
this header works fine in Flume itself, but breaks in ElasticSearch:
https://www.elastic.co/guide/en/elasticsearch/reference/2.0/_mapping_changes.html#_field_names_may_not_contain_dots
The offending code is here:
https://github.com/apache/flume/blob/67ed62aa18df3675b68369d0d00c8f0dcbdfb970/flume-ng-core/src/main/java/org/apache/flume/source/SyslogUtils.java#L92
(And in a few other places)
This should be easily fixable by renaming the field to 'Status' -- which is
more in-line with the rest of the fields there anyways.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
