Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adding caveats section #389

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions docs/add_fields.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,3 +48,24 @@ For the above configuration the event console display will be like:
On clicking additional field, logtrail will automatically search for log messages matching the value of the field. For example on clicking the pid `16545` in above message, logtrail will search for all message whose pid is `16545` in this index.

Logtrail uses Handlebar templates to replace the fields in `message_format` with actual values. `{{{field_name}}}` will add field with hyperlink. `{{field_name}}` will add field without hyperlink. `{{[nested.field]}}` should be used to add nested fields.


### Caveats

#### Nested fields

Some fields may appear as nested in Kibana while actually they are not. When displaying a document in "table view" in Kibana, these 2 fields will be displayed the same way :
- log.level
- [log][level] (following Logstash syntax)

When displaying the document in json view, you'll see clearly the difference though.

If you configure Logtrail as below :

"message_format": "{{{log.level}}} - {{{message}}}"

It will work **only** if log.level is really nested (ie [log][level]). It will not work if your documents have a simple field named "log.level".
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What should be the message format string to display non-nested log.level field?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What should be the message format string to display non-nested log.level field?

very good question ! but I actually don't know ;-(


See this [issue](https://github.com/sivasamyk/logtrail/issues/387) for more infos.