elastic/logstash

Consider improving Logstash configs in the docs/static/filebeat_modules/*/*.conf

Open

#8,527 opened on Oct 25, 2017

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Ruby (14,197 stars) (3,496 forks)batch import
good first issuehacktoberfestmodules

Description

These configs are part of the "adding Logstash to filebeat modules getting started experience" and therefore its very likely the first time a user will see a LS config.

For the best experience we should add a fair few comments to better inform what is going on. The user sees the nested field reference for the first time and there is a try three grok pattern scheme with two mutate renames that work only if earlier grok patterns fail that could be explained better. Also, we should add grok and date parse failure handling.

Optionally, we could add anchors to Grok patterns.

Contributor guide

Tech stack
None
Domain
documentation
Issue type
documentation
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Basic knowledge of Logstash config syntaxFamiliarity with Grok patterns
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75
Research direction
Examine the existing .conf files in the docs/static/filebeat modules/ directories. Identify areas where nested field references, grok pattern schemes, and mutate renames are used. Add clear comments explaining each step. Implement error handling for grok and date parse failures, possibly using conditional logic. Optionally, add anchors to Grok patterns for clarity. Review Logstash best practices for configuration documentation.
Consider improving Logstash configs in the docs/static/filebeat_modules/*/*.conf · elastic/logstash#8527 | Good First Issue