[jira] [Commented] (FLUME-2838) Syslog Sinks use 'flume.syslog.status' header which breaks in ElasticSearch 2.0

["Hari Shreedharan (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FLUME-2838?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14994407#comment-14994407 ] 

Hari Shreedharan commented on FLUME-2838:
-----------------------------------------

lets make it configurable, so we don't regress

> Syslog Sinks use 'flume.syslog.status' header which breaks in ElasticSearch 2.0
> -------------------------------------------------------------------------------
>
>                 Key: FLUME-2838
>                 URL: https://issues.apache.org/jira/browse/FLUME-2838
>             Project: Flume
>          Issue Type: Bug
>          Components: Sinks+Sources
>    Affects Versions: v1.6.0
>            Reporter: Matt Wise
>
> The EVENT_STATUS header is written to a header named 'flume.syslog.status' -- this header works fine in Flume itself, but breaks in ElasticSearch: https://www.elastic.co/guide/en/elasticsearch/reference/2.0/_mapping_changes.html#_field_names_may_not_contain_dots
> The offending code is here: https://github.com/apache/flume/blob/67ed62aa18df3675b68369d0d00c8f0dcbdfb970/flume-ng-core/src/main/java/org/apache/flume/source/SyslogUtils.java#L92  (And in a few other places)
> This should be easily fixable by renaming the field to 'Status' -- which is more in-line with the rest of the fields there anyways.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)