Change Details

https://logstash.wikimedia.org/#/dashboard/elasticsearch/default https://logstash.wikimedia.org/#/dashboard/elasticsearch/restbase These both have an empty "message" column for messages from restbase. When inspecting an individual entry, it seems restbase uses an "info" field instead. Can we transform this somehow?

https://logstash.wikimedia.org/#/dashboard/elasticsearch/default And after e.g. focussing on type=restbase These both have an empty "message" column for messages from restbase. When inspecting an individual entry, it seems restbase uses an "info" field instead. And also a "res.body.title" and "res.body.err.message". Can we transform these somehow to at least also have a "message" field populated? Should probably be an alias to one of these. Or the result of concatenating them.

https://logstash.wikimedia.org/#/dashboard/elasticsearch/default https://logstash.wikimedia.org/#/dashboard/elasticsearch/restbase And after e.g. focussing on type=restbase These both have an empty "message" column for messages from restbase. When inspecting an individual entry, it seems restbase uses an "info" field instead. And also a "res.body.title" and "res.body.err.message". Can we transform these somehow to at least also have a "message" field populated? Should probably be an alias to one of these. Can we transform this somehow?Or the result of concatenating them.