You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[elasticsearchexporter] support dynamic mapping modes (#38114)
#### Description
Add support for controlling the mapping mode via a client metadata key
(typically an HTTP or gRPC header), X-Elastic-Mapping-Mode. This will
override the mode specified in `mapping::mode`, which now serves as the
default.
We also introduce `mapping::allowed_modes` config which restricts
mapping modes to those listed. This will allow an administrator to lock
down the allowed mapping modes that can be specified through client
metadata.
Because we want to set "require_data_stream=true" for otel mode, and we
no longer know ahead of time which mapping mode will be used, we now
create a BulkIndexer per mapping mode.
#### Link to tracking issue
Closes#36092
#### Testing
- Added unit tests
- Tested against a live collector with telemetrygen, passing
`--otlp-header X-Elastic-Mapping-Mode=\"<mode>\"`
#### Documentation
Updated README.
---------
Co-authored-by: Carson Ip <[email protected]>
Copy file name to clipboardExpand all lines: exporter/elasticsearchexporter/README.md
+32-19Lines changed: 32 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -157,28 +157,41 @@ This can be customised through the following settings:
157
157
The Elasticsearch exporter supports several document schemas and preprocessing
158
158
behaviours, which may be configured through the following settings:
159
159
160
-
- `mapping`: Events are encoded to JSON. The `mapping` allows users to
161
-
configure additional mapping rules.
162
-
- `mode` (default=none): The fields naming mode. valid modes are:
163
-
- `none`: Use original fields and event structure from the OTLP event.
164
-
- `ecs`: Try to map fields to [Elastic Common Schema (ECS)][ECS]
165
-
- `otel`: Elastic's preferred "OTel-native" mapping mode. Uses original fields and event structure from the OTLP event.
166
-
- There's a special treatment for the following attributes: `data_stream.type`, `data_stream.dataset`, `data_stream.namespace`. Instead of serializing these values under the `*attributes.*` namespace, they're put at the root of the document, to conform with the conventions of the data stream naming scheme that maps these as `constant_keyword` fields.
167
-
- `data_stream.dataset` will always be appended with `.otel`. It is recommended to use with `*_dynamic_index.enabled: true` to route documents to data stream `${data_stream.type}-${data_stream.dataset}-${data_stream.namespace}`.
168
-
- Span events are stored in separate documents. They will be routed with `data_stream.type` set to `logs` if `traces_dynamic_index::enabled` is `true`.
169
-
170
-
- `raw`: Omit the `Attributes.` string prefixed to field names for log and
171
-
span attributes as well as omit the `Events.` string prefixed to
172
-
field names for span events.
173
-
- `bodymap`: Provides fine-grained control over the final documents to be ingested.
174
-
:warning: This mode's behavior is unstable, it is currently experimental and undergoing changes.
175
-
It works only for logs where the log record body is a map. Each LogRecord
176
-
body is serialized to JSON as-is and becomes a separate document for ingestion.
177
-
If the log record body is not a map, the exporter will log a warning and drop the log record.
160
+
- `mapping`:
161
+
- `mode` (default=none): The default mapping mode. Valid modes are:
162
+
- `none`
163
+
- `ecs`
164
+
- `otel`
165
+
- `raw`
166
+
- `bodymap`
167
+
- `allowed_modes` (defaults to all mapping modes): A list of allowed mapping modes.
168
+
169
+
The mapping mode can also be controlled via the client metadata key `X-Elastic-Mapping-Mode`,
170
+
e.g. via HTTP headers, gRPC metadata. This will override the configured `mapping::mode`.
171
+
It is possible to restrict which mapping modes may be requested by configuring
172
+
`mapping::allowed_modes`, which defaults to all mapping modes. Keep in mind that not all
173
+
processors or exporter configurations will maintain client
174
+
metadata.
175
+
176
+
See below for a description of each mapping mode.
178
177
179
178
#### OTel mapping mode
180
179
181
-
In `otel` mapping mode, the Elasticsearch Exporter stores documents in an OTel-native schema.
180
+
In `otel` mapping mode, the Elasticsearch Exporter stores documents in Elastic's preferred
181
+
"OTel-native"schema. In this mapping mode, documents use the original attribute names and
182
+
closely follows the event structure from the OTLP events.
183
+
184
+
There is special treatment for the following attributes: `data_stream.type`, `data_stream.dataset`,
185
+
and `data_stream.namespace`. Instead of serializing these values under the `*attributes.*` namespace,
186
+
they are put at the root of the document, to conform with the conventions of the data stream naming
187
+
scheme that maps these as `constant_keyword` fields.
188
+
189
+
`data_stream.dataset`will always be appended with `.otel`. It is recommended to use with
190
+
`*_dynamic_index::enabled: true` (e.g. `logs_dynamic_index::enabled`) to route documents to data stream
0 commit comments