Skip to content

Commit

Permalink
[7.17](backport #37229) Only log events at debug level (#37256)
Browse files Browse the repository at this point in the history
The Elasticsearch client was logging raw events in error and warn level, this commit makes it only log the raw events (or any event data) at debug level. This means the error message returned by Elasticsearch is now only available at debug level because it can contain the whole value of a field causing a mapping conflict.

---------

Co-authored-by: Craig MacKenzie <[email protected]>
(cherry picked from commit ac7309a)
  • Loading branch information
mergify[bot] authored Dec 1, 2023
1 parent b856730 commit 2b92fca
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 3 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d

*Affecting all Beats*

- Avoid logging fields values when handling Elasticsearch output errors except at the debug log level. The debug log level must now be used to see detailed errors, for example mapping errors and their cause. {pull}37229[37229]

*Auditbeat*

Expand Down
9 changes: 6 additions & 3 deletions libbeat/outputs/elasticsearch/client.go
Original file line number Diff line number Diff line change
Expand Up @@ -393,10 +393,12 @@ func (client *Client) bulkCollectPublishFails(result eslegclient.BulkResult, dat
result, _ := data[i].Content.Meta.HasKey(dead_letter_marker_field)
if result {
stats.nonIndexable++
client.log.Errorf("Can't deliver to dead letter index event %#v (status=%v): %s", data[i], status, msg)
client.log.Errorf("Can't deliver to dead letter index event (status=%v). Enable debug logs to view the event and cause.", status)
client.log.Debugf("Can't deliver to dead letter index event %#v (status=%v): %s", data[i], status, msg)
// poison pill - this will clog the pipeline if the underlying failure is non transient.
} else if client.NonIndexableAction == dead_letter_index {
client.log.Warnf("Cannot index event %#v (status=%v): %s, trying dead letter index", data[i], status, msg)
client.log.Warnf("Cannot index event (status=%v), trying dead letter index. Enable debug logs to view the event and cause.", status)
client.log.Debugf("Cannot index event %#v (status=%v): %s, trying dead letter index", data[i], status, msg)
if data[i].Content.Meta == nil {
data[i].Content.Meta = common.MapStr{
dead_letter_marker_field: true,
Expand All @@ -411,7 +413,8 @@ func (client *Client) bulkCollectPublishFails(result eslegclient.BulkResult, dat
}
} else { // drop
stats.nonIndexable++
client.log.Warnf("Cannot index event %#v (status=%v): %s, dropping event!", data[i], status, msg)
client.log.Warnf("Cannot index event (status=%v): dropping event!", status)
client.log.Debugf("Cannot index event %#v (status=%v): %s, dropping event! Enable debug logs to view the event and cause.", data[i], status, msg)
continue
}
}
Expand Down

0 comments on commit 2b92fca

Please sign in to comment.