logstash: rename syslog facility to facility_name when it's a string
Such facility ids are generated by NetworkManager but the journalbeat index mapping is expecting a long (7.15.2)
Related to T3705
Test Plan
-logstash0:
diff origin/production/logstash0.internal.softwareheritage.org current/logstash0.internal.softwareheritage.org
*******************************************
File[/etc/logstash/conf.d/filter.conf] =>
parameters =>
content =>
@@ -31,4 +31,9 @@
}
} else {
+ if [syslog][facility] !~ /^\d+$/ {
+ mutate {
+ rename => { "[syslog][facility]" => "[syslog][facility_name]" }
+ }
+ }
if [@metadata][version] {
mutate {
*******************************************
*** End octocatalog-diff on logstash0.internal.softwareheritage.org
Migrated from D6665 (view on Phabricator)