Uncovered while working on T382105: Increase in Logstash warning logs
function-evaluator-javascript-evaluator
{
"@timestamp": "2025-01-10T21:42:16.231Z",
"ecs.version": "8.10.0",
"log.level": "info",
"message": "Incoming evaluator request",
"request": { <-- Must be nested inside a "http" hash or dot-delimited e.g. "http.request" https://doc.wikimedia.org/ecs/#ecs-http
"headers": {
"user-agent": "kube-probe/1.23",
"x-request-id": "258db3fa-d55c-4d72-a76d-8f93f944f9e2"
},
"method": "GET",
"params": {
"0": "/_info"
},
"query": {},
"remoteAddress": "10.64.0.105",
"remotePort": 44150,
"url": "/_info"
},
"requestId": "258db3fa-d55c-4d72-a76d-8f93f944f9e2", <-- Only need one of these and should be part of http hash e.g. "http.request.id" https://doc.wikimedia.org/ecs/#field-http-request-id
"request_id": "258db3fa-d55c-4d72-a76d-8f93f944f9e2",
"service": "function-evaluator" <-- Service must be a hash, e.g. "service.name" https://doc.wikimedia.org/ecs/#field-service-name
}function-evaluator-python-evaluator
{
"@timestamp": "2025-01-10T21:31:29.435Z",
"ecs.version": "8.10.0",
"log.level": "info",
"message": "Incoming evaluator request",
"request": {
"headers": { <-- Must be nested inside a "http" hash or dot-delimited e.g. "http.request" https://doc.wikimedia.org/ecs/#ecs-http
"user-agent": "kube-probe/1.23",
"x-request-id": "b3059da9-be9a-47c5-be35-eda150f0227f"
},
"method": "GET",
"params": {
"0": "/_info"
},
"query": {},
"remoteAddress": "10.64.32.110",
"remotePort": 55134,
"url": "/_info"
},
"requestId": "b3059da9-be9a-47c5-be35-eda150f0227f", <-- Only need one of these and should be part of http hash e.g. "http.request.id" https://doc.wikimedia.org/ecs/#field-http-request-id
"request_id": "b3059da9-be9a-47c5-be35-eda150f0227f",
"service": "function-evaluator" <-- Service must be a hash, e.g. "service.name" https://doc.wikimedia.org/ecs/#field-service-name
}