-
Notifications
You must be signed in to change notification settings - Fork 164
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add Extract host IP section to logs stream docs #3155
Conversation
A documentation preview will be available soon: |
[source,console] | ||
---- | ||
PUT /logs-example-default/_mapping | ||
{ | ||
"properties": { | ||
"host.ip": { | ||
"type": "ip", | ||
"ignore_malformed": true | ||
} | ||
} | ||
} | ||
---- |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not sure if this is the recommended way of updating the mapping to ignore malformed IPs. It's what I found in the docs, but let me know if there is a preferred way.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
|
||
[discrete] | ||
[[logs-stream-host-ip-query]] | ||
=== Query logs based on `host.ip` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CIDR notation and range queries were the two ways to query that I found most prevalent. Are there any additional ways to query we might add?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A couple suggestions, otherwise LGTM
(cherry picked from commit af924a2)
(cherry picked from commit af924a2)
|
||
[discrete] | ||
[[logs-stream-ip-ignore-malformed]] | ||
=== Ignore malformed IP addresses |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice way of introducing ignore_malformed
👍
This PR closes Issue 3122.