[jira] [Commented] (FLUME-2099) Add serializer to ElasticSearchSink for new logstash v1 format

["Otis Gospodnetic (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FLUME-2099?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13702054#comment-13702054 ] 

Otis Gospodnetic commented on FLUME-2099:
-----------------------------------------

I read the JIRA title and couldn't make sense of it - how Flume and LogStash and ES are related, knowing Flume can write to ES, but so can LogStash.

bq. The ElasticSearchSink aims to allow users to write just as if logstash does

So this issue is for really *for* LogStash, but really to *match* the LogStash format?

                
> Add serializer to ElasticSearchSink for new logstash v1 format
> --------------------------------------------------------------
>
>                 Key: FLUME-2099
>                 URL: https://issues.apache.org/jira/browse/FLUME-2099
>             Project: Flume
>          Issue Type: Improvement
>          Components: Sinks+Sources
>    Affects Versions: v1.4.0
>            Reporter: Edward Sargisson
>
> The logstash maintainer has implemented an improved message schema for elasticsearch which he plans to deploy in the next version https://logstash.jira.com/browse/LOGSTASH-675
> The ElasticSearchSink aims to allow users to write just as if logstash does - largely so Kibana can work. A serializer should be added to allow the new format to be used.
> Benefits (from the logstash work item):
> *    kibana isn't polluted with "@" symbols everywhere
> *    most relevant data is in 'event fields' which is now top-level, no longer "@fields.somefield"
> *    fewer "required" event fields.
> *    the 'json' input format can go away or generally mean the same thing as json_event

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira