Page MenuHomePhabricator

Resolve excessive field creation in logstash
Closed, DuplicatePublic

Description

Logstash has a crazy number of fields currently of the form: constraintParameters.P2303.datavalue.value.entity-type

There are many Q numbers, and values after them. For reference every unique field sent to elasticsearch creates a field, much like a database schema. We can't name database schema fields after individual items. Potential solutions vary, in the past we have encouraged projects to serialize (likely json) blobs of debugging information that they want generally findable, but don't need to be indexed on a property by property basis.