[8.15](backport #41099) [aws] Change log.file.path field in awscloudw…

…atch input to nested object (#41163) * [aws] Change log.file.path field in awscloudwatch input to nested object (#41099) Change log.file.path field in awscloudwatch input to nested object (cherry picked from commit 904d14b) --------- Co-authored-by: kaiyan-sheng <[email protected]>
elastic · Oct 8, 2024 · 2a714a1 · 2a714a1
1 parent 7e45173
commit 2a714a1
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 3 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -26,6 +26,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Removed deprecated Cylance from Beats. See <<migrate-from-deprecated-module>> for migration options. {pull}38037[38037]
 - Removed deprecated Bluecoat from Beats. See <<migrate-from-deprecated-module>> for migration options. {pull}38037[38037]
 - Introduce input/netmetrics and refactor netflow input metrics {pull}38055[38055]
+- Change log.file.path field in awscloudwatch input to nested object. {pull}41099[41099]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/input/awscloudwatch/input_test.go b/x-pack/filebeat/input/awscloudwatch/input_test.go
@@ -29,7 +29,11 @@ func TestCreateEvent(t *testing.T) {
 		"event": mapstr.M{
 			"id": *logEvent.EventId,
 		},
-		"log.file.path": "logGroup1" + "/" + *logEvent.LogStreamName,
+		"log": mapstr.M{
+			"file": mapstr.M{
+				"path": "logGroup1" + "/" + *logEvent.LogStreamName,
+			},
+		},
 		"awscloudwatch": mapstr.M{
 			"log_group":      "logGroup1",
 			"log_stream":     *logEvent.LogStreamName,

diff --git a/x-pack/filebeat/input/awscloudwatch/processor.go b/x-pack/filebeat/input/awscloudwatch/processor.go
@@ -44,8 +44,12 @@ func createEvent(logEvent types.FilteredLogEvent, logGroup string, regionName st
 	event := beat.Event{
 		Timestamp: time.Unix(*logEvent.Timestamp/1000, 0).UTC(),
 		Fields: mapstr.M{
-			"message":       *logEvent.Message,
-			"log.file.path": logGroup + "/" + *logEvent.LogStreamName,
+			"message": *logEvent.Message,
+			"log": mapstr.M{
+				"file": mapstr.M{
+					"path": logGroup + "/" + *logEvent.LogStreamName,
+				},
+			},
 			"event": mapstr.M{
 				"id":       *logEvent.EventId,
 				"ingested": time.Now(),